CycloneDX / CycloneDX/cyclonedx-cli

Validation of BOM Generated by Jake

Open
#113 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

cyclonedx-cli 0.14.0 is not validating a BOM [jake-bom.xml](https://github.com/sonatype-nexus-community/cyclonedx-sbom-examples/blob/master/jake-bom.xml) from Sonatype's [cyclonedx-sbom-examples](https://github.com/sonatype-nexus-community/cyclonedx-sbom-examples) repo.

The BOM appears to be schema v1.1 using the vulnerability extension. It is not pretty printed, so here is an edited version:

```



yaspin
0.16.0?extension=tar.gz
pkg:pypi/yaspin@0.16.0?extension=tar.gz


wrapt
1.12.1?extension=tar.gz
pkg:pypi/wrapt@1.12.1?extension=tar.gz

```

This is the output from cyclonedx-cli 0.14.0

```
$ ./cyclonedx-win-x86.exe validate --input-file jake-bom.xml
Validating XML SBOM...
Invalid namespace URI: expected http://cyclonedx.org/schema/bom/1.2 actual http://cyclonedx.org/schema/bom/1.1

$ ./cyclonedx-win-x86.exe validate --input-file jake-bom.xml --input-format autodetect
Validating XML SBOM...
Invalid namespace URI: expected http://cyclonedx.org/schema/bom/1.2 actual http://cyclonedx.org/schema/bom/1.1

$ ./cyclonedx-win-x86.exe validate --input-file jake-bom.xml --input-format xml_v1_1
Validating XML SBOM...
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.