Add jarmode tools SBOM command - #51505
Open
xxxxxxjun wants to merge 2 commits into
Open
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
Add an 'sbom' command to the tools jar mode which prints the SBOM packaged in an uber jar or war. The SBOM is located using the Sbom-Location manifest attribute and its bytes are copied verbatim to the console, or to the file given by --destination. Signed-off-by: Hyeongjun Cho <ryuu.public@gmail.com>
ToolsJarMode wrapped every exception in IllegalStateException, so a JarModeErrorException thrown by a command never reached the simple message branch of JarModeRunner and was printed as a stack trace. Rethrow it so failures such as a missing SBOM are reported as 'Error: <message>' with a non-zero exit code. Signed-off-by: Hyeongjun Cho <ryuu.public@gmail.com>
xxxxxxjun
force-pushed
the
add-jarmode-tools-sbom-command
branch
from
August 29, 2026 18:25
94897a0 to
74ccdfb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an
sbomcommand to thetoolsjar mode. Given an uber jar or war, it prints the packaged SBOM. Reading that SBOM currently means starting the application and calling the actuator'ssbomendpoint.To find the SBOM, the command reads the
Sbom-Locationmanifest attribute and uses the value as-is: the Gradle plugin already writes theWEB-INF/classes/prefix for wars. The entry at that location is written byte for byte to the console, or to the file given by--destination. Because the output is meant to be piped elsewhere, the command exits with a non-zero code if it can't write to the console.The second commit fixes a problem this command exposed.
ToolsJarModewrapped every exception inIllegalStateException, so aJarModeErrorExceptionnever reachedJarModeRunner'sError: <message>branch and was printed as a stack trace. That matters here because CycloneDX generation is opt-in, and "no SBOM found" is likely to be the most common outcome forsbom. Rethrowing the exception ahead of the generic catch restores that branch. It also changes whatextractandlist-layersprint when they fail, so I'm happy to move it to its own PR if you'd prefer.Closes #45954