Package io.quarkus.sbom

Class CoreSbomContributionConfig

java.lang.Object
io.quarkus.sbom.CoreSbomContributionConfig
public class CoreSbomContributionConfig extends Object
Assembles the core Quarkus application SBOM contribution from Maven artifacts and packaged files.

This class collects raw inputs — the ApplicationModel, main component identity, additional component descriptors, and file system paths — and defers all processing until toSbomContribution() is called. In particular, ComponentDescriptors for the application model's dependencies are not created eagerly during configuration.

The main application component is resolved in the following priority order:

  1. If setMainPurl(Purl) is set, a new component with that PURL is created (typically a generic PURL for native images or runner jars).
  2. If setMainArtifact(ResolvedDependency) is set, a Maven-PURL component is derived from it.
  3. Otherwise the application artifact from the ApplicationModel is used.

Only the core contribution designates a main application component. Extension-contributed SbomContributions should not provide one.

Typical usage: 


 var contribution = new CoreSbomContributionConfig()
         .setApplicationModel(appModel)
         .setDistributionDirectory(buildDir)
         .setMainPath(runnerJar)
         .toSbomContribution();

  • Constructor Details

    • CoreSbomContributionConfig

      public CoreSbomContributionConfig()

  • Method Details

    • setApplicationModel

      public CoreSbomContributionConfig setApplicationModel(ApplicationModel model)
      Sets the application model whose dependencies will be converted to ComponentDescriptors when toSbomContribution() is called. The model's application artifact also serves as the default main component when neither setMainPurl(io.quarkus.sbom.Purl) nor setMainArtifact(io.quarkus.maven.dependency.ResolvedDependency) is specified.
      Parameters:
      model - the resolved application model
      Returns:
      this config

    • setMainArtifact

      public CoreSbomContributionConfig setMainArtifact(ResolvedDependency dep)
      Sets the main component from a resolved Maven artifact. A Maven PURL and dependency list are derived from it automatically. Use this when the main component is a Maven artifact whose identity differs from the application model's application artifact, or when no application model is set.
      Parameters:
      dep - the resolved dependency representing the main artifact
      Returns:
      this config

    • setMainPurl

      public CoreSbomContributionConfig setMainPurl(Purl purl)
      Overrides the main component's PURL. Use this for non-Maven main components such as native images or runner jars that need a generic PURL instead of a Maven one.
      Parameters:
      purl - the PURL identifying the main component
      Returns:
      this config

    • setMainDependencies

      public CoreSbomContributionConfig setMainDependencies(Collection<ArtifactCoords> dependencies)
      Sets the direct dependencies of the main component explicitly. These are used to mark components as top-level in the generated SBOM. If not set, the dependencies are obtained from the main artifact's ResolvedDependency.getDependencies().
      Parameters:
      dependencies - the main component's direct dependency coordinates
      Returns:
      this config

    • setPedigrees

      public CoreSbomContributionConfig setPedigrees(Map<ArtifactKey,String> pedigrees)
      Sets pedigree notes for application model dependencies, keyed by artifact. The pedigree for each dependency is applied when toSbomContribution() creates its component descriptor.
      Parameters:
      pedigrees - artifact-key-to-pedigree map, or null
      Returns:
      this config

    • setDistributionDirectory

      public CoreSbomContributionConfig setDistributionDirectory(Path distributionDirectory)
      Sets the distribution directory. When set, files in this directory that are not already registered as components are added with generic PURLs, and component distribution paths are resolved relative to this directory.
      Parameters:
      distributionDirectory - the build output directory
      Returns:
      this config

    • setMainPath

      public CoreSbomContributionConfig setMainPath(Path runnerPath)
      Sets the file system path of the main runnable artifact (e.g. runner jar, native image). This path is recorded on the SbomContribution and also overrides the main component's file path for hash computation and distribution path resolution.
      Parameters:
      runnerPath - path to the main runnable artifact
      Returns:
      this config

    • addComponent

      public CoreSbomContributionConfig addComponent(ComponentDescriptor component)
      Adds an extra component descriptor not derived from the application model. Use this for non-Maven components such as build-generated files that need a generic PURL.
      Parameters:
      component - the component descriptor
      Returns:
      this config

    • addComponent

      public CoreSbomContributionConfig addComponent(ResolvedDependency dep)
      Adds a Maven dependency as a component. The Maven PURL, path, and scope are derived from the dependency.
      Parameters:
      dep - the resolved Maven dependency
      Returns:
      this config

    • addComponent

      public CoreSbomContributionConfig addComponent(ResolvedDependency dep, Path path)
      Adds a Maven dependency as a component with a file path that differs from the dependency's resolved path (e.g. after copying to a distribution directory).
      Parameters:
      dep - the resolved Maven dependency
      path - the actual file path of the component artifact
      Returns:
      this config

    • addComponent

      public CoreSbomContributionConfig addComponent(ResolvedDependency dep, Path path, String pedigree)
      Adds a Maven dependency as a component with a custom file path and optional pedigree notes describing modifications (e.g. tree-shaken classes).
      Parameters:
      dep - the resolved Maven dependency
      path - the actual file path, or null to use the dependency's resolved path
      pedigree - pedigree notes, or null
      Returns:
      this config

    • addFileDependency

      public CoreSbomContributionConfig addFileDependency(Path parent, Path child)
      Declares that the component at parent path depends on the component at child path. Both paths must correspond to files in the distribution directory so that they can be resolved to components during toSbomContribution().
      Parameters:
      parent - file path of the parent component
      child - file path of the child component
      Returns:
      this config

    • toSbomContribution

      public SbomContribution toSbomContribution()
      Converts this config into an SbomContribution, creating component descriptors from the application model, deduplicating by file path and Maven artifact key, resolving distribution paths, and producing the dependency graph.

      This is the only path that designates a main application component in the SBOM.

      Returns:
      an SbomContribution representing the core application manifest