CycloneDX / CycloneDX/cyclonedx-cli
Dependency-Graph in Dependency-Track not working after MERGE - Docker image - Kali Linux
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
after merging SBoMs with the CLI the Dependency-Graph in Dtrack for that SBoM is only showing the first hierarchy level (the primary-components of the merged SBoMs), but not any of the components that make up these components.
The Dependency-Graphs are working for each individual SBoM just fine. The "component"-metadata is set in each individual sbom and the bom-refs of these first hierarchy level components are also showing up in "Dependencies" in the final SBoM.
Here is the code I have used:
` docker run -v /home/kalimitteuser/Downloads:/work cyclonedx/cyclonedx-cli merge \ `
` --input-files /work/2.json /work/1.json /work/3.json --version 1.139.16 \ `
` --name application --hierarchical --output-file /work/sbom_all.json`
It results in this output:
`Processing input file /work/2.json
Contains 168 components
Processing input file /work/1.json
Contains 292 components
Processing input file /work/3.json
Contains 156 components
Writing output file...
Total 3 components`
I think the problem is with the last line "Total 3 components". Can I insert an option like "--hierarchical **all**" or something like that? Maybe this is even a Dtrack problem as there are something around 350 components inside that SBoM?
Thanks in advance.
Contributor guide
Assessment
This issue has not been assessed yet.