CycloneDX / CycloneDX/cyclonedx-cli

Dependency-Graph in Dependency-Track not working after MERGE - Docker image - Kali Linux

Open
#230 5 comments 5 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

Hello,

after merging SBoMs with the CLI the Dependency-Graph in Dtrack for that SBoM is only showing the first hierarchy level (the primary-components of the merged SBoMs), but not any of the components that make up these components.
The Dependency-Graphs are working for each individual SBoM just fine. The "component"-metadata is set in each individual sbom and the bom-refs of these first hierarchy level components are also showing up in "Dependencies" in the final SBoM.

Here is the code I have used:
` docker run -v /home/kalimitteuser/Downloads:/work cyclonedx/cyclonedx-cli merge \ `
` --input-files /work/2.json /work/1.json /work/3.json --version 1.139.16 \ `
` --name application --hierarchical --output-file /work/sbom_all.json`

It results in this output:
`Processing input file /work/2.json
Contains 168 components
Processing input file /work/1.json
Contains 292 components
Processing input file /work/3.json
Contains 156 components
Writing output file...
Total 3 components`

I think the problem is with the last line "Total 3 components". Can I insert an option like "--hierarchical **all**" or something like that? Maybe this is even a Dtrack problem as there are something around 350 components inside that SBoM?

Thanks in advance.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.