Packager#isCycloneDxBom only recognized CycloneDX SBOMs beneath
META-INF/sbom/. In a war, the CycloneDX Maven plugin's output is
packaged beneath WEB-INF/classes/META-INF/sbom/, so repackaging did
not add the SBOM manifest attributes.
Also check beneath Layout#getClassesLocation(), which findMainMethod
already uses to locate application classes. Continue to support the
root location used by jars.
Signed-off-by: COBI-98 <tkdgus968@naver.com>
See gh-51551
In BootZipCopyAction and AbstractJarWriter, SHA-1 hash is calculated for
stored entries requiring unpack and set as entry comment. However, the
hash isn't used anywhere, just the marker prefix 'UNPACK:' is checked.
This commit removes the unnecessary SHA-1 hash calculation which reads
the file completely in memory, potentially three times in extreme cases.
Now the comment is simply set to 'UNPACK:' without any hash, improving
performance.
See gh-46520
Signed-off-by: Hyunjoon Choi <hyunjoon@example.com>
Signed-off-by: academey <academey@gmail.com>
Andy Wilkinson
COBI-98
Manu Sridharan
Stéphane Nicoll
Phillip Webb
Moritz Halbritter
academey