Add jarmode tools command to print the SBOM

Add an 'sbom' command to the tools jar mode which prints the SBOM
packaged in an uber jar or war. The SBOM is located using the
Sbom-Location manifest attribute and its bytes are copied verbatim to
the console, or to the file given by --destination.

See gh-51505

Signed-off-by: Hyeongjun Cho <ryuu.public@gmail.com>
This commit is contained in:
Hyeongjun Cho
2026-09-02 16:26:35 +02:00
committed by Moritz Halbritter
parent a2869a0c6b
commit 962ca36126
11 changed files with 314 additions and 1 deletions
@@ -116,6 +116,8 @@ plugins {
}
----
TIP: To print the SBOM packaged in an uber jar or war, run `java -Djarmode=tools -jar my-app.jar sbom`.
[[howto.build.customize-dependency-versions]]
@@ -22,6 +22,7 @@ Usage:
Available commands:
extract Extract the contents from the jar
list-layers List layers from the jar that can be extracted
sbom Print the SBOM from the jar
help Help about any command
----