SpringBoot SBOM actuator endpoint doesn't work in a native image

Comment From: mhalbritter

We need to register the missing resource hints, e.g. like this:

class SbomHints implements RuntimeHintsRegistrar {
    private static final List<String> DEFAULT_APPLICATION_SBOM_LOCATIONS = List.of("classpath:META-INF/sbom/bom.json", "classpath:META-INF/sbom/application.cdx.json");

    @Override
    public void registerHints(RuntimeHints hints, ClassLoader classLoader) {
        for (String location : DEFAULT_APPLICATION_SBOM_LOCATIONS) {
            hints.resources().registerPattern(location.replace("classpath:", ""));
        }
    }
}

However, this isn't enough. When using Gradle, the bootJar task is configured to include the SBOM from $buildDir/reports into META-INF/sbom/application.cdx.json. But we invoke native-image with the plain jar file, not the uber jar. This can be fixed with this Gradle snippet, however this might not be the best way:

jar {
    dependsOn(':cyclonedxBom')
    from(project.layout.buildDirectory.dir('reports')) {
        include('application.cdx.json') into 'META-INF/sbom'
    }
}

For Maven, registering the resource hints is enough.

Comment From: mhalbritter

Might be related to https://github.com/spring-projects/spring-boot/issues/40890.

Comment From: mhalbritter

Got something in https://github.com/mhalbritter/spring-boot/tree/mh/40890-react-to-cyclonedx-gradle-plugin-application.