CycloneDX / CycloneDX/cyclonedx-cli
Validation of BOM Generated by Jake
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
cyclonedx-cli 0.14.0 is not validating a BOM [jake-bom.xml](https://github.com/sonatype-nexus-community/cyclonedx-sbom-examples/blob/master/jake-bom.xml) from Sonatype's [cyclonedx-sbom-examples](https://github.com/sonatype-nexus-community/cyclonedx-sbom-examples) repo.
The BOM appears to be schema v1.1 using the vulnerability extension. It is not pretty printed, so here is an edited version:
```
yaspin
0.16.0?extension=tar.gz
pkg:pypi/yaspin@0.16.0?extension=tar.gz
wrapt
1.12.1?extension=tar.gz
pkg:pypi/wrapt@1.12.1?extension=tar.gz
```
This is the output from cyclonedx-cli 0.14.0
```
$ ./cyclonedx-win-x86.exe validate --input-file jake-bom.xml
Validating XML SBOM...
Invalid namespace URI: expected http://cyclonedx.org/schema/bom/1.2 actual http://cyclonedx.org/schema/bom/1.1
$ ./cyclonedx-win-x86.exe validate --input-file jake-bom.xml --input-format autodetect
Validating XML SBOM...
Invalid namespace URI: expected http://cyclonedx.org/schema/bom/1.2 actual http://cyclonedx.org/schema/bom/1.1
$ ./cyclonedx-win-x86.exe validate --input-file jake-bom.xml --input-format xml_v1_1
Validating XML SBOM...
```
Contributor guide
Assessment
This issue has not been assessed yet.