CycloneDX / CycloneDX/cyclonedx-cli

`Instance validation error: 'sha1' is not a valid value for HashAlgorithm` when merging SBOMs

Open
#235 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

I've tried to merge SBOMs, in 1 of which there is next component:
```

org.jpype
cpe:2.3:a:org.jpype:org.jpype:*:*:*:*:*:*:*:*
pkg:maven/org.jpype/org.jpype




c65b70607ea15cc2d95efdf4e2ea94ce65100eb6




java-cataloger
java
JavaMetadata
java-archive
sha256:531683537a69f672df2f68b5a23a3060046e48325191c517a9fd08dfe923a430
/home/dragent/.local/share/virtualenvs/dragent-WrTQ1u9h/lib/python3.8/site-packages/org.jpype.jar
/home/dragent/.local/share/virtualenvs/dragent-WrTQ1u9h/lib/python3.8/site-packages/org.jpype.jar


```
When I've executed the command:
```
cyclonedx-cli merge --group GRP --name Nmae --version 2.0 \
--input-files ${NGINX_REPORTS}/Details/Anchore-SBOM.xml ${NGINX_REPORTS}/Details/CI-SBOM.xml \
--output-file ${NGINX_REPORTS}/Details/Anchore-SBOM-merged.xml
```
I've got next error:
```
Processing input file /home/<...>/reports/Details/Anchore-SBOM.xml
Unhandled exception: System.InvalidOperationException: There is an error in XML document (7694, 19).
---> System.InvalidOperationException: Instance validation error: 'sha1' is not a valid value for HashAlgorithm.
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read2_HashAlgorithm(String s)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read4_Hash(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read6_ExternalReference(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read30_Component(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read50_Bom(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read51_bom()
--- End of inner exception stack trace ---
at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle, XmlDeserializationEvents events)
at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle)
at System.Xml.Serialization.XmlSerializer.Deserialize(Stream stream)
at CycloneDX.Xml.Serializer.Deserialize(MemoryStream xmlStream)
at CycloneDX.Xml.Serializer.Deserialize(Stream xmlStream)
at CycloneDX.Cli.CliUtils.InputBomHelper(String filename, CycloneDXBomFormat format)
at CycloneDX.Cli.Commands.MergeCommand.InputBoms(IEnumerable`1 inputFilenames, CycloneDXBomFormat inputFormat, Boolean outputToConsole)
at CycloneDX.Cli.Commands.MergeCommand.Merge(MergeCommandOptions options)
at System.CommandLine.Invocation.CommandHandler.GetExitCodeAsync(Object value, InvocationContext context)
at System.CommandLine.Invocation.ModelBindingCommandHandler.InvokeAsync(InvocationContext context)
at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass23_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass16_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass27_0.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass25_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__24_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass22_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass11_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__10_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass14_0.<b__0>d.MoveNext()
```
BTW, before merging I did validation for both SBOMs and this issue was not reported:
```
Validating XML BOM...
Validation failed at line number 4911 and position 19: The 'http://cyclonedx.org/schema/bom/1.4:id' element is invalid - The value 'GD' is invalid according to its datatype 'http://cyclonedx.org/schema/spdx:licenseId' - The Enumeration constraint failed.
BOM is not valid.
Validating XML BOM...
BOM validated successfully.
```
The reported issue during validation is already reported here as separate [ticket](https://github.com/CycloneDX/cyclonedx-cli/issues/220) and located higher in the SBOM file than this one, so 2 cases possible:
- Validate command fails on 1st issue and doesn't validate rest of the file at all
- Validate command doesn't detect this case as issue, while merge command fails to process it

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.