diff --git a/README.md b/README.md index 33def12..2649a43 100644 --- a/README.md +++ b/README.md @@ -171,10 +171,24 @@ Among several sub-directories underneath the `layers/sbom/launch` directory, you +- sbom.syft.json ``` -Unfortunately, these files are not available and accessible in the container image at runtime. But what you can do is make a copy of the `sbom.cdx.json` file, like so: +Unfortunately, these files are not available and accessible in the container image at runtime. But what you can do is make a copy of the `sbom.cdx.json` file. + +Set a variable name. + +For applications with dependencies on Spring Boot 3.2, set + +``` +SBOM_FILENAME=sbom.json +``` + +For applications with dependencies on Spring Boot 3.3 or better, set ``` -cp -f layers/sbom/launch/paketo-buildpacks_executable-jar/sbom.cdx.json src/main/resources/META-INF/sbom/application.cdx.json +SBOM_FILENAME=META-INF/sbom/application.cdx.json +``` + +``` +cp -f layers/sbom/launch/paketo-buildpacks_executable-jar/sbom.cdx.json src/main/resources/$SBOM_FILENAME ``` Then rebuild the container image. (Remember to repeat this process for any change you make to source). @@ -202,6 +216,15 @@ And if you want to expose the `/actuator/info`, `/actuator/jars` and `/actuator/ ``` > where `endpoints` above is a sibling of (shares the same indentation as) `info` +Also, note if you want to expose the `/actuator/sbom` endpoint, available since Spring Boot 3.3, you'll need to update the above to be + +``` +endpoints: + web: + exposure: + include: "health,info,jars,pom,sbom" +``` + Build your application, then start it up. Visit the above-mentioned custom [actuator endpoints](https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html).