Skip to content

Commit bac9dbf

Browse files
committed
Add demos for Embedding SBOM in Native Image
1 parent 3b93e72 commit bac9dbf

File tree

9 files changed

+214
-1
lines changed

9 files changed

+214
-1
lines changed

.github/workflows/native-image-configure-with-tracing-agent.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ permissions:
1515
contents: read
1616
jobs:
1717
run:
18-
name: Run 'native-image/configure-with-tracing-agent
18+
name: Run 'native-image/configure-with-tracing-agent'
1919
runs-on: ubuntu-latest
2020
timeout-minutes: 15
2121
strategy:
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: native-image/embed-sbom
2+
on:
3+
push:
4+
paths:
5+
- 'native-image/embed-sbom/**'
6+
- '.github/workflows/native-image-embed-sbom.yml'
7+
pull_request:
8+
paths:
9+
- 'native-image/embed-sbom/**'
10+
- '.github/workflows/native-image-embed-sbom.yml'
11+
schedule:
12+
- cron: "0 0 1 * *" # run every month
13+
workflow_dispatch:
14+
permissions:
15+
contents: read
16+
jobs:
17+
run:
18+
name: Run 'native-image/embed-sbom'
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 15
21+
steps:
22+
- uses: actions/checkout@v4
23+
- uses: graalvm/setup-graalvm@v1
24+
with:
25+
java-version: '24-ea'
26+
distribution: 'graalvm'
27+
github-token: ${{ secrets.GITHUB_TOKEN }}
28+
native-image-job-reports: 'true'
29+
- name: Run 'native-image/embed-sbom'
30+
run: |
31+
cd native-image/embed-sbom
32+
./run.sh

native-image/embed-sbom/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Embed an SBOM in a Native Executable to Identify Its Dependencies
2+
3+
You can find the steps to run this demo on [the website](https://www.graalvm.org/latest/reference-manual/native-image/guides/use-sbom-support/).

native-image/embed-sbom/index.html

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<title>jwebserver</title>
5+
</head>
6+
<body>
7+
<h2>Hello, GraalVM user!<p>
8+
</body>
9+
</html>

native-image/embed-sbom/jwebserver

15.1 MB
Binary file not shown.

native-image/embed-sbom/run.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
set -ex
3+
4+
native-image -Ob --enable-sbom=cyclonedx -m jdk.httpserver -o jwebserver
5+
6+
# Requires GraalVM for JDK 24 Early Access build 24.ea.23-graal or later:
7+
# sdk install java 24.ea.23-graal
8+
# cd sbom-test
9+
# mvn clean package
10+
# mvn -Pnative package
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Including Class-Level Metadata in the SBOM
2+
3+
This demo tests including class-level metadata to the SBOM components at build time.
4+
Find more information on [the website](https://www.graalvm.org/jdk24/security-guide/native-image/sbom/#including-class-level-metadata-in-the-sbom).
5+
6+
> Available with GraalVM for JDK 24 and later.
Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
<project xmlns="http://maven.apache.org/POM/4.0.0"
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<groupId>com.sbom</groupId>
6+
<artifactId>sbom-test</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
9+
<properties>
10+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
11+
<maven.compiler.source>21</maven.compiler.source>
12+
<maven.compiler.target>21</maven.compiler.target>
13+
<native.maven.plugin.version>0.10.3</native.maven.plugin.version>
14+
</properties>
15+
16+
<dependencies>
17+
<!-- Apache Commons Validator -->
18+
<dependency>
19+
<groupId>commons-validator</groupId>
20+
<artifactId>commons-validator</artifactId>
21+
<version>1.7</version>
22+
</dependency>
23+
</dependencies>
24+
25+
<build>
26+
<pluginManagement>
27+
<plugins>
28+
<plugin>
29+
<groupId>org.apache.maven.plugins</groupId>
30+
<artifactId>maven-jar-plugin</artifactId>
31+
<version>3.4.2</version>
32+
<configuration>
33+
<archive>
34+
<manifest>
35+
<mainClass>com.sbom.SBOMTestApplication</mainClass>
36+
</manifest>
37+
</archive>
38+
</configuration>
39+
</plugin>
40+
<plugin>
41+
<groupId>org.apache.maven.plugins</groupId>
42+
<artifactId>maven-compiler-plugin</artifactId>
43+
<version>3.10.1</version>
44+
</plugin>
45+
</plugins>
46+
</pluginManagement>
47+
</build>
48+
49+
<profiles>
50+
<profile>
51+
<id>native</id>
52+
<build>
53+
<plugins>
54+
<plugin>
55+
<groupId>org.graalvm.buildtools</groupId>
56+
<artifactId>native-maven-plugin</artifactId>
57+
<version>${native.maven.plugin.version}</version>
58+
<extensions>true</extensions>
59+
<executions>
60+
<execution>
61+
<id>build-native</id>
62+
<goals>
63+
<goal>compile-no-fork</goal>
64+
</goals>
65+
<phase>package</phase>
66+
</execution>
67+
</executions>
68+
<configuration>
69+
<buildArgs>
70+
<buildArg>--enable-sbom=class-level</buildArg>
71+
<buildArg>-Ob</buildArg>
72+
</buildArgs>
73+
</configuration>
74+
</plugin>
75+
</plugins>
76+
</build>
77+
</profile>
78+
</profiles>
79+
80+
</project>
Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* The Universal Permissive License (UPL), Version 1.0
6+
*
7+
* Subject to the condition set forth below, permission is hereby granted to any
8+
* person obtaining a copy of this software, associated documentation and/or
9+
* data (collectively the "Software"), free of charge and under any and all
10+
* copyright rights in the Software, and any and all patent rights owned or
11+
* freely licensable by each licensor hereunder covering either (i) the
12+
* unmodified Software as contributed to or provided by such licensor, or (ii)
13+
* the Larger Works (as defined below), to deal in both
14+
*
15+
* (a) the Software, and
16+
*
17+
* (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
18+
* one is included with the Software each a "Larger Work" to which the Software
19+
* is contributed by such licensors),
20+
*
21+
* without restriction, including without limitation the rights to copy, create
22+
* derivative works of, display, perform, and distribute the Software and make,
23+
* use, sell, offer for sale, import, export, have made, and have sold the
24+
* Software and the Larger Work(s), and to sublicense the foregoing rights on
25+
* either these or other terms.
26+
*
27+
* This license is subject to the following condition:
28+
*
29+
* The above copyright notice and either this complete permission notice or at a
30+
* minimum a reference to the UPL must be included in all copies or substantial
31+
* portions of the Software.
32+
*
33+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
34+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
35+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
36+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
37+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
38+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
39+
* SOFTWARE.
40+
*/
41+
42+
package com.sbom;
43+
44+
import org.apache.commons.validator.routines.RegexValidator;
45+
46+
public class SBOMTestApplication {
47+
private static final boolean IS_EMPTY_OR_BLANK = new RegexValidator("^[\\s]*$").isValid(" ");
48+
49+
public static void main(String[] argv) {
50+
System.out.println(String.valueOf(IS_EMPTY_OR_BLANK));
51+
ClassInSameFile someClass = new ClassInSameFile("hello ", "world");
52+
someClass.doSomething();
53+
}
54+
}
55+
56+
class ClassInSameFile {
57+
private final String value1;
58+
private final String value2;
59+
60+
ClassInSameFile(String value1, String value2) {
61+
this.value1 = value1;
62+
this.value2 = value2;
63+
}
64+
65+
void doSomething() {
66+
System.out.println(value1 + value2);
67+
}
68+
69+
// This method is unreachable and will therefore not be included in the SBOM
70+
String unreachable() {
71+
return value1 + value2;
72+
}
73+
}

0 commit comments

Comments
 (0)