CycloneDX / CycloneDX/cyclonedx-cli
Merge command looses `metadata.component` from original SBOMs
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
I've merged 2 SBOMs, but found that resulting SBOM doesn't contain `metadata.component` from original SBOMs.
Executed command:
```
cyclonedx-cli merge \
--input-files ${NGINX_REPORTS}/Details/Anchore-SBOM.xml ${NGINX_REPORTS}/Details/CI-SBOM.xml \
--output-file ${NGINX_REPORTS}/Details/SBOM-merged.xml
```
If add `--group Group --name Name --version 2.0`, exactly this info will be in `metadata.component`, but info from SBOM 1 is lost anyway.
SBOM 1:
```
2022-03-19T01:08:07Z
anchore
syft
0.42.0
image:prod-latest
sha256:a1725721cde80b5c787a9208f80ea0df350ae82f229e1cab0000e1cd8e9f4046
```
SBOM 2:
```
2022-03-18T23:11:18.271283+00:00
CycloneDX
cyclonedx-python-lib
2.0.0
https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE
https://github.com/CycloneDX/cyclonedx-python-lib
https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md
https://cyclonedx.org
https://cyclonedx.github.io/cyclonedx-python-lib/
https://pypi.org/project/cyclonedx-python-lib/
https://github.com/CycloneDX/cyclonedx-python-lib/actions
https://github.com/CycloneDX/cyclonedx-python-lib/issues
CycloneDX
cyclonedx-bom
3.1.0
```
Resulting SBOM:
```
anchore
syft
0.42.0
CycloneDX
cyclonedx-python-lib
2.0.0
https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE
https://github.com/CycloneDX/cyclonedx-python-lib
https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md
https://cyclonedx.org
https://cyclonedx.github.io/cyclonedx-python-lib/
https://pypi.org/project/cyclonedx-python-lib/
https://github.com/CycloneDX/cyclonedx-python-lib/actions
https://github.com/CycloneDX/cyclonedx-python-lib/issues
CycloneDX
cyclonedx-bom
3.1.0
```
Contributor guide
Assessment
This issue has not been assessed yet.