Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve documentation for CycloneDX integration

Browse Source 
Closes gh-41506
This commit is contained in:
Moritz Halbritter
2024-10-14 11:37:54 +02:00
parent 2e086365fe
commit 5754be36f1
4 changed files with 45 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
spring-boot-project/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc
View File

@@ -1256,33 +1256,10 @@ If you reach the `info` endpoint, you should see a response that contains the fo
The `sbom` endpoint exposes the https://en.wikipedia.org/wiki/Software_supply_chain[Software Bill of Materials].
CycloneDX SBOMs can be auto-detected, but other formats can be manually configured, too.
The `spring-boot-starter-parent` Maven parent and the Spring Boot Gradle plugin configure the https://github.com/CycloneDX/cyclonedx-maven-plugin[CycloneDX Maven plugin] and the https://github.com/CycloneDX/cyclonedx-gradle-plugin[CycloneDX Gradle plugin] respectively.
To get a CycloneDX SBOM, you'll need to add this to your Maven build:
[source,xml]
----
<build>
<plugins>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
----
For Gradle, you'll need to apply the CycloneDX Gradle plugin:
[source,groovy]
----
plugins {
id 'org.cyclonedx.bom' version '1.8.2'
}
----
The `sbom` actuator endpoint will then expose an SBOM called "application", which describes the contents of your application.
TIP: To automatically generate a CycloneDX SBOM at project build time, please see the xref:how-to:build.adoc#howto.build.generate-cyclonedx-sbom[] section.
[[actuator.endpoints.sbom.other-formats]]