{"id":51423924,"url":"https://github.com/dashaun/spring-boot-4-0-sbom","last_synced_at":"2026-07-05T01:30:35.043Z","repository":{"id":358954579,"uuid":"1242983136","full_name":"dashaun/spring-boot-4-0-sbom","owner":"dashaun","description":"Expose and use SBOM with Spring Boot 4","archived":false,"fork":false,"pushed_at":"2026-05-19T18:45:01.000Z","size":1341,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-19T22:11:49.678Z","etag":null,"topics":["sbom","spring-boot","spring-boot-actuator","spring-security","trivy"],"latest_commit_sha":null,"homepage":"http://dashaun.com/spring-boot-4-0-sbom/","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dashaun.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-19T00:17:05.000Z","updated_at":"2026-05-19T18:45:24.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/dashaun/spring-boot-4-0-sbom","commit_stats":null,"previous_names":["dashaun/spring-boot-4-0-sbom"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/dashaun/spring-boot-4-0-sbom","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fspring-boot-4-0-sbom","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fspring-boot-4-0-sbom/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fspring-boot-4-0-sbom/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fspring-boot-4-0-sbom/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dashaun","download_url":"https://codeload.github.com/dashaun/spring-boot-4-0-sbom/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dashaun%2Fspring-boot-4-0-sbom/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35141083,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["sbom","spring-boot","spring-boot-actuator","spring-security","trivy"],"created_at":"2026-07-05T01:30:34.567Z","updated_at":"2026-07-05T01:30:35.013Z","avatar_url":"https://github.com/dashaun.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Spring Boot 4 — SBOM Generation, Exposure \u0026 Scanning\n\nA demo-heavy presentation repo that walks through generating a CycloneDX Software Bill of Materials at build time, exposing it via the Spring Boot Actuator, separating it onto a dedicated management port, securing it with Spring Security, and consuming it with [Trivy](https://trivy.dev) for vulnerability scanning.\n\n\u003e Companion presentation lives in [`docs/`](./docs/) (Reveal.js, served from any static host).\n\n## Quick start\n\n```bash\n# JDK 25 + a recent Maven (the wrapper takes care of Maven)\ngit clone https://github.com/dashaun/spring-boot-4-sbom\ncd spring-boot-4-sbom\n\ncd labs/lab-1-baseline \u0026\u0026 ./mvnw spring-boot:run\n```\n\n## The four labs\n\n| Lab | What it adds | App port | Mgmt port |\n|---|---|---|---|\n| [lab-1-baseline](./labs/lab-1-baseline) | Plain Spring Boot 4 web app | 8081 | — |\n| [lab-2-sbom](./labs/lab-2-sbom) | CycloneDX plugin + `/actuator/sbom` | 8082 | 8082 (same) |\n| [lab-3-mgmt-port](./labs/lab-3-mgmt-port) | Dedicated management port for actuators | 8083 | 9083 |\n| [lab-4-secured](./labs/lab-4-secured) | Spring Security: HTTP Basic + role-based actuator access | 8084 | 9084 |\n\nEach lab is a standalone Maven project. Run `./mvnw spring-boot:run` from inside any of them.\n\n## The demo arc\n\n1. **Build it** — `./mvnw package` in lab-2 onward embeds a CycloneDX SBOM in the jar (`META-INF/sbom/application.cdx.json`).\n2. **Expose it** — `/actuator/sbom` lists embedded SBOMs; `/actuator/sbom/application` returns the JSON.\n3. **Isolate it** — lab-3 moves the actuator to a separate port (`9083`) so you can firewall it.\n4. **Secure it** — lab-4 adds HTTP Basic auth with an `ACTUATOR_ADMIN` role required for `/actuator/sbom`.\n5. **Scan it** — `./scripts/scan-with-trivy.sh` pulls the secured SBOM and pipes it through `trivy sbom -`.\n\n```bash\n# Lab 4 — auth required\nhttp http://localhost:9084/actuator/sbom               # → 401\nhttp --check-status -a admin:changeme --print=b GET \\\n  http://localhost:9084/actuator/sbom/application | trivy sbom -\n```\n\n## Running the presentation\n\n```bash\njwebserver -d \"$(pwd)/docs\" -p 8000\n# open http://localhost:8000\n```\n\n## Presenting\n\nPresenter cheatsheet lives in the **speaker notes of the deck itself** (press `S` in Reveal.js to open speaker view). The title slide carries pre-flight + setup; each lab's title slide carries its timing and paste-able demo commands.\n\n## Companion docs\n\n- [`CLAUDE.md`](./CLAUDE.md) — architecture \u0026 build commands (for AI coding assistants)\n- [`AGENTS.md`](./AGENTS.md) — per-lab build/test matrix\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdashaun%2Fspring-boot-4-0-sbom","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdashaun%2Fspring-boot-4-0-sbom","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdashaun%2Fspring-boot-4-0-sbom/lists"}