This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 0c875db9c4cb chore: update SBOM docs with Spring Boot built-in support
and Quarkus extension
0c875db9c4cb is described below
commit 0c875db9c4cb6ca1ebec84399b063c62f333e6f5
Author: Claus Ibsen <[email protected]>
AuthorDate: Mon Jun 22 20:29:25 2026 +0200
chore: update SBOM docs with Spring Boot built-in support and Quarkus
extension
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---
docs/user-manual/modules/ROOT/pages/sbom.adoc | 42 ++++++++++++---------------
1 file changed, 18 insertions(+), 24 deletions(-)
diff --git a/docs/user-manual/modules/ROOT/pages/sbom.adoc
b/docs/user-manual/modules/ROOT/pages/sbom.adoc
index c0289a86e534..48a7775cd0e3 100644
--- a/docs/user-manual/modules/ROOT/pages/sbom.adoc
+++ b/docs/user-manual/modules/ROOT/pages/sbom.adoc
@@ -59,36 +59,30 @@ camel sbom --sbom-output-format=xml
See the xref:jbang-commands/camel-jbang-sbom.adoc[camel sbom command
reference] for all available options.
-=== Camel Spring Boot and Camel Quarkus (Maven projects)
+=== Camel Spring Boot
-For Maven-based projects (Camel Spring Boot or Camel Quarkus), add the
-https://github.com/CycloneDX/cyclonedx-maven-plugin[CycloneDX Maven Plugin] to
your `pom.xml`:
+Spring Boot 3.3+ has
https://spring.io/blog/2024/05/24/sbom-support-in-spring-boot-3-3/[built-in
SBOM support]:
+it generates a CycloneDX SBOM during the build, packages it inside the uber
jar at
+`META-INF/sbom/application.cdx.json`, and can expose it via an actuator
endpoint. Since Camel Spring Boot
+runs on top of Spring Boot, this automatically covers Camel and all its
transitive dependencies — no extra
+plugin or Camel-specific configuration needed.
+
+=== Camel Quarkus
+
+Quarkus has its own dependency resolver that differs from standard Maven
resolution, which means the generic
+CycloneDX Maven plugin will not capture the full dependency graph. Instead,
use the native
+https://quarkus.io/guides/cyclonedx[Quarkus CycloneDX extension]. Add it to
your project:
[source,xml]
----
-<plugin>
- <groupId>org.cyclonedx</groupId>
- <artifactId>cyclonedx-maven-plugin</artifactId>
- <version>2.9.1</version>
- <executions>
- <execution>
- <phase>package</phase>
- <goals>
- <goal>makeBom</goal>
- </goals>
- </execution>
- </executions>
-</plugin>
+<dependency>
+ <groupId>io.quarkus</groupId>
+ <artifactId>quarkus-cyclonedx</artifactId>
+</dependency>
----
-Running `mvn package` will then produce a CycloneDX SBOM alongside your
application artifact.
-
-This is a standard Maven plugin and works identically for both Camel Spring
Boot and Camel Quarkus projects.
-Nothing Camel-specific is required.
-
-TIP: Check https://github.com/CycloneDX/cyclonedx-maven-plugin[the plugin's
repository] for the latest
-version, and see the plugin documentation for options such as output format
(JSON or XML), output directory,
-and component scope filtering.
+This generates a distribution SBOM automatically every time you build. You can
also generate a dependency
+SBOM before building with `mvn quarkus:dependency-sbom`.
== Analyzing SBOMs
