CycloneDX / CycloneDX/cyclonedx-cli
Validation fails for valid JSON BOMs
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
I'm using the CLI to ensure that `cyclonedx-go` and `cyclonedx-gomod` produce valid BOMs.
While implementing support for spec v1.4 in `cyclonedx-go`, I noticed that some JSON BOMs fail to validate without apparent reason.
The validation fails not only for the BOMs produced by the Go tooling, but also for the input test files from the [ `specification`](https://github.com/CycloneDX/specification) repo.
When testing the offending files using other tools like https://www.jsonschemavalidator.net/ with the [official schema](https://github.com/CycloneDX/specification/blob/master/schema/bom-1.4.schema.json), validation succeeds.
### Steps to reproduce
```bash
# Clone specification repo
git clone https://github.com/CycloneDX/specification cdx-spec
# Validate all supposedly valid BOMs
for file in cdx-spec/tools/src/test/resources/1.4/valid-*.json; do echo "\n#### $file:" && cyclonedx validate --input-version v1_4 --input-file $file; done
```
This yields 3 failing validations:
```
#### tools/src/test/resources/1.4/valid-bom-1.4.json:
Validating JSON BOM...
Validation failed:
#
BOM is not valid.
#### tools/src/test/resources/1.4/valid-release-notes-1.4.json:
Validating JSON BOM...
Validation failed:
#
BOM is not valid.
#### tools/src/test/resources/1.4/valid-service-1.4.json:
Validating JSON BOM...
Validation failed:
#
BOM is not valid.
```
The same happens when validating files within `tools/src/test/resources/1.4/valid-*.json` using `--input-version v1_3`, albeit only for `valid-bom-1.3.json`. I did not observe this behavior with XML BOMs.
Contributor guide
Assessment
This issue has not been assessed yet.