mirror of
https://github.com/spring-projects/spring-boot.git
synced 2026-09-17 20:19:06 +00:00
Packager#isCycloneDxBom only recognized CycloneDX SBOMs beneath META-INF/sbom/. In a war, the CycloneDX Maven plugin's output is packaged beneath WEB-INF/classes/META-INF/sbom/, so repackaging did not add the SBOM manifest attributes. Also check beneath Layout#getClassesLocation(), which findMainMethod already uses to locate application classes. Continue to support the root location used by jars. Signed-off-by: COBI-98 <tkdgus968@naver.com> See gh-51551