graalvm · olyagpl · Dec 19, 2024 · Dec 5, 2024 · Dec 5, 2024 · olyagpl
diff --git a/.github/workflows/native-image-configure-with-tracing-agent.yml b/.github/workflows/native-image-configure-with-tracing-agent.yml
@@ -15,7 +15,7 @@ permissions:
   contents: read
 jobs:
   run:
-    name: Run 'native-image/configure-with-tracing-agent
+    name: Run 'native-image/configure-with-tracing-agent'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     strategy:

diff --git a/.github/workflows/native-image-embed-sbom.yml b/.github/workflows/native-image-embed-sbom.yml
@@ -0,0 +1,32 @@
+name: native-image/embed-sbom
+on:
+  push:
+    paths:
+      - 'native-image/embed-sbom/**'
+      - '.github/workflows/native-image-embed-sbom.yml'
+  pull_request:
+    paths:
+      - 'native-image/embed-sbom/**'
+      - '.github/workflows/native-image-embed-sbom.yml'
+  schedule:
+    - cron: "0 0 1 * *" # run every month
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  run:
+    name: Run 'native-image/embed-sbom'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: graalvm/setup-graalvm@v1
+        with:
+          java-version: '24-ea'
+          distribution: 'graalvm'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          native-image-job-reports: 'true'
+      - name: Run 'native-image/embed-sbom'
+        run: |
+          cd native-image/embed-sbom
+          ./run.sh
diff --git a/native-image/embed-sbom/README.md b/native-image/embed-sbom/README.md
@@ -0,0 +1,3 @@
+# Embed an SBOM in a Native Executable to Identify Its Dependencies
+
+You can find the steps to run this demo on [the website](https://www.graalvm.org/latest/reference-manual/native-image/guides/use-sbom-support/).
diff --git a/native-image/embed-sbom/index.html b/native-image/embed-sbom/index.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <title>jwebserver</title>
+    </head>
+    <body>
+    <h2>Hello, GraalVM user!<p>
+    </body>
+</html>
diff --git a/native-image/embed-sbom/jwebserver b/native-image/embed-sbom/jwebserver
diff --git a/native-image/embed-sbom/run.sh b/native-image/embed-sbom/run.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -ex
+
+native-image -Ob --enable-sbom=cyclonedx -m jdk.httpserver -o jwebserver
+
+# Requires GraalVM for JDK 24 Early Access build 24.ea.23-graal or later:
+# sdk install java 24.ea.23-graal
+cd sbom-test
+mvn clean package
+mvn -Pnative package
diff --git a/native-image/embed-sbom/sbom-test/README.md b/native-image/embed-sbom/sbom-test/README.md
@@ -0,0 +1,6 @@
+# Including Class-Level Metadata in the SBOM
+
+This demo tests including class-level metadata to the SBOM components at build time. 
+Find more information on [the website](https://www.graalvm.org/jdk24/security-guide/native-image/sbom/#including-class-level-metadata-in-the-sbom).
+
+> Available with GraalVM for JDK 24 and later.
diff --git a/native-image/embed-sbom/sbom-test/pom.xml b/native-image/embed-sbom/sbom-test/pom.xml
@@ -0,0 +1,80 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.sbom</groupId>
+    <artifactId>sbom-test</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>21</maven.compiler.source>
+        <maven.compiler.target>21</maven.compiler.target>
+		<native.maven.plugin.version>0.10.3</native.maven.plugin.version>
+    </properties>
+
+    <dependencies>
+        <!-- Apache Commons Validator -->
+        <dependency>
+            <groupId>commons-validator</groupId>
+            <artifactId>commons-validator</artifactId>
+            <version>1.7</version>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-jar-plugin</artifactId>
+                    <version>3.4.2</version>
+                    <configuration>
+                        <archive>
+                            <manifest>
+                                <mainClass>com.sbom.SBOMTestApplication</mainClass>
+                            </manifest>
+                        </archive>
+                    </configuration>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-compiler-plugin</artifactId>
+                    <version>3.10.1</version>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>native</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.graalvm.buildtools</groupId>
+                        <artifactId>native-maven-plugin</artifactId>
+                        <version>${native.maven.plugin.version}</version>
+                        <extensions>true</extensions>
+                        <executions>
+                            <execution>
+                                <id>build-native</id>
+                                <goals>
+                                    <goal>compile-no-fork</goal>
+                                </goals>
+                                <phase>package</phase>
+                            </execution>
+                        </executions>
+                        <configuration>
+                            <buildArgs>
+                                <buildArg>--enable-sbom=class-level</buildArg>
+                                <buildArg>-Ob</buildArg>
+                            </buildArgs>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
+</project>
diff --git a/native-image/embed-sbom/sbom-test/src/main/java/com/sbom/SBOMTestApplication.java b/native-image/embed-sbom/sbom-test/src/main/java/com/sbom/SBOMTestApplication.java
@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * The Universal Permissive License (UPL), Version 1.0
+ *
+ * Subject to the condition set forth below, permission is hereby granted to any
+ * person obtaining a copy of this software, associated documentation and/or
+ * data (collectively the "Software"), free of charge and under any and all
+ * copyright rights in the Software, and any and all patent rights owned or
+ * freely licensable by each licensor hereunder covering either (i) the
+ * unmodified Software as contributed to or provided by such licensor, or (ii)
+ * the Larger Works (as defined below), to deal in both
+ *
+ * (a) the Software, and
+ *
+ * (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
+ * one is included with the Software each a "Larger Work" to which the Software
+ * is contributed by such licensors),
+ *
+ * without restriction, including without limitation the rights to copy, create
+ * derivative works of, display, perform, and distribute the Software and make,
+ * use, sell, offer for sale, import, export, have made, and have sold the
+ * Software and the Larger Work(s), and to sublicense the foregoing rights on
+ * either these or other terms.
+ *
+ * This license is subject to the following condition:
+ *
+ * The above copyright notice and either this complete permission notice or at a
+ * minimum a reference to the UPL must be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+package com.sbom;
+
+import org.apache.commons.validator.routines.RegexValidator;
+
+public class SBOMTestApplication {
+    private static final boolean IS_EMPTY_OR_BLANK = new RegexValidator("^[\\s]*$").isValid(" ");
+
+    public static void main(String[] argv) {
+        System.out.println(String.valueOf(IS_EMPTY_OR_BLANK));
+        ClassInSameFile someClass = new ClassInSameFile("hello ", "world");
+        someClass.doSomething();
+    }
+}
+
+class ClassInSameFile {
+    private final String value1;
+    private final String value2;
+
+    ClassInSameFile(String value1, String value2) {
+        this.value1 = value1;
+        this.value2 = value2;
+    }
+
+    void doSomething() {
+        System.out.println(value1 + value2);
+    }
+
+    // This method is unreachable and will therefore not be included in the SBOM
+    String unreachable() {
+        return value1 + value2;
+    }
+}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		# Embed an SBOM in a Native Executable to Identify Its Dependencies

		You can find the steps to run this demo on [the website](https://www.graalvm.org/latest/reference-manual/native-image/guides/use-sbom-support/).