CycloneDX / CycloneDX/cyclonedx-cli

Merge command looses `metadata.component` from original SBOMs

Open
#218 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

I've merged 2 SBOMs, but found that resulting SBOM doesn't contain `metadata.component` from original SBOMs.
Executed command:
```
cyclonedx-cli merge \
--input-files ${NGINX_REPORTS}/Details/Anchore-SBOM.xml ${NGINX_REPORTS}/Details/CI-SBOM.xml \
--output-file ${NGINX_REPORTS}/Details/SBOM-merged.xml
```
If add `--group Group --name Name --version 2.0`, exactly this info will be in `metadata.component`, but info from SBOM 1 is lost anyway.

SBOM 1:
```

2022-03-19T01:08:07Z

anchore
syft
0.42.0

image:prod-latest
sha256:a1725721cde80b5c787a9208f80ea0df350ae82f229e1cab0000e1cd8e9f4046

```

SBOM 2:
```

2022-03-18T23:11:18.271283+00:00

CycloneDX
cyclonedx-python-lib
2.0.0

https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE

https://github.com/CycloneDX/cyclonedx-python-lib

https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md

https://cyclonedx.org

https://cyclonedx.github.io/cyclonedx-python-lib/

https://pypi.org/project/cyclonedx-python-lib/

https://github.com/CycloneDX/cyclonedx-python-lib/actions

https://github.com/CycloneDX/cyclonedx-python-lib/issues

CycloneDX
cyclonedx-bom
3.1.0

```

Resulting SBOM:
```



anchore
syft
0.42.0



CycloneDX
cyclonedx-python-lib
2.0.0



https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE


https://github.com/CycloneDX/cyclonedx-python-lib


https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md


https://cyclonedx.org


https://cyclonedx.github.io/cyclonedx-python-lib/


https://pypi.org/project/cyclonedx-python-lib/


https://github.com/CycloneDX/cyclonedx-python-lib/actions


https://github.com/CycloneDX/cyclonedx-python-lib/issues




CycloneDX
cyclonedx-bom
3.1.0




```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.