We need to register the missing resource hints, e.g. like this:

class SbomHints implements RuntimeHintsRegistrar {
    private static final List<String> DEFAULT_APPLICATION_SBOM_LOCATIONS = List.of("classpath:META-INF/sbom/bom.json", "classpath:META-INF/sbom/application.cdx.json");

    @Override
    public void registerHints(RuntimeHints hints, ClassLoader classLoader) {
        for (String location : DEFAULT_APPLICATION_SBOM_LOCATIONS) {
            hints.resources().registerPattern(location.replace("classpath:", ""));
        }
    }
}

However, this isn't enough. When using Gradle, the bootJar task is configured to include the SBOM from $buildDir/reports into META-INF/sbom/application.cdx.json. But we invoke native-image with the plain jar file, not the uber jar. This can be fixed with this Gradle snippet, however this might not be the best way:

jar {
	dependsOn(':cyclonedxBom')
	from(project.layout.buildDirectory.dir('reports')) {
		include('application.cdx.json') into 'META-INF/sbom'
	}
}

For Maven, registering the resource hints is enough.

SBOM actuator endpoint doesn't work in a native image #40939

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions