CycloneDX / CycloneDX/cyclonedx-cli

Validation fails for valid JSON BOMs

Open
#202 6 comments 1 reaction 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

I'm using the CLI to ensure that `cyclonedx-go` and `cyclonedx-gomod` produce valid BOMs.

While implementing support for spec v1.4 in `cyclonedx-go`, I noticed that some JSON BOMs fail to validate without apparent reason.
The validation fails not only for the BOMs produced by the Go tooling, but also for the input test files from the [ `specification`](https://github.com/CycloneDX/specification) repo.

When testing the offending files using other tools like https://www.jsonschemavalidator.net/ with the [official schema](https://github.com/CycloneDX/specification/blob/master/schema/bom-1.4.schema.json), validation succeeds.

### Steps to reproduce

```bash
# Clone specification repo
git clone https://github.com/CycloneDX/specification cdx-spec

# Validate all supposedly valid BOMs
for file in cdx-spec/tools/src/test/resources/1.4/valid-*.json; do echo "\n#### $file:" && cyclonedx validate --input-version v1_4 --input-file $file; done
```

This yields 3 failing validations:

```
#### tools/src/test/resources/1.4/valid-bom-1.4.json:
Validating JSON BOM...
Validation failed:
#
BOM is not valid.

#### tools/src/test/resources/1.4/valid-release-notes-1.4.json:
Validating JSON BOM...
Validation failed:
#
BOM is not valid.

#### tools/src/test/resources/1.4/valid-service-1.4.json:
Validating JSON BOM...
Validation failed:
#
BOM is not valid.
```

The same happens when validating files within `tools/src/test/resources/1.4/valid-*.json` using `--input-version v1_3`, albeit only for `valid-bom-1.3.json`. I did not observe this behavior with XML BOMs.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.