CycloneDX / CycloneDX/cyclonedx-cli
`Instance validation error: 'sha1' is not a valid value for HashAlgorithm` when merging SBOMs
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
I've tried to merge SBOMs, in 1 of which there is next component:
```
org.jpype
cpe:2.3:a:org.jpype:org.jpype:*:*:*:*:*:*:*:*
pkg:maven/org.jpype/org.jpype
c65b70607ea15cc2d95efdf4e2ea94ce65100eb6
java-cataloger
java
JavaMetadata
java-archive
sha256:531683537a69f672df2f68b5a23a3060046e48325191c517a9fd08dfe923a430
/home/dragent/.local/share/virtualenvs/dragent-WrTQ1u9h/lib/python3.8/site-packages/org.jpype.jar
/home/dragent/.local/share/virtualenvs/dragent-WrTQ1u9h/lib/python3.8/site-packages/org.jpype.jar
```
When I've executed the command:
```
cyclonedx-cli merge --group GRP --name Nmae --version 2.0 \
--input-files ${NGINX_REPORTS}/Details/Anchore-SBOM.xml ${NGINX_REPORTS}/Details/CI-SBOM.xml \
--output-file ${NGINX_REPORTS}/Details/Anchore-SBOM-merged.xml
```
I've got next error:
```
Processing input file /home/<...>/reports/Details/Anchore-SBOM.xml
Unhandled exception: System.InvalidOperationException: There is an error in XML document (7694, 19).
---> System.InvalidOperationException: Instance validation error: 'sha1' is not a valid value for HashAlgorithm.
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read2_HashAlgorithm(String s)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read4_Hash(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read6_ExternalReference(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read30_Component(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read50_Bom(Boolean isNullable, Boolean checkType)
at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReaderBom.Read51_bom()
--- End of inner exception stack trace ---
at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle, XmlDeserializationEvents events)
at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle)
at System.Xml.Serialization.XmlSerializer.Deserialize(Stream stream)
at CycloneDX.Xml.Serializer.Deserialize(MemoryStream xmlStream)
at CycloneDX.Xml.Serializer.Deserialize(Stream xmlStream)
at CycloneDX.Cli.CliUtils.InputBomHelper(String filename, CycloneDXBomFormat format)
at CycloneDX.Cli.Commands.MergeCommand.InputBoms(IEnumerable`1 inputFilenames, CycloneDXBomFormat inputFormat, Boolean outputToConsole)
at CycloneDX.Cli.Commands.MergeCommand.Merge(MergeCommandOptions options)
at System.CommandLine.Invocation.CommandHandler.GetExitCodeAsync(Object value, InvocationContext context)
at System.CommandLine.Invocation.ModelBindingCommandHandler.InvokeAsync(InvocationContext context)
at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass23_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass16_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass27_0.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass25_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__24_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass22_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass11_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__10_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass14_0.<b__0>d.MoveNext()
```
BTW, before merging I did validation for both SBOMs and this issue was not reported:
```
Validating XML BOM...
Validation failed at line number 4911 and position 19: The 'http://cyclonedx.org/schema/bom/1.4:id' element is invalid - The value 'GD' is invalid according to its datatype 'http://cyclonedx.org/schema/spdx:licenseId' - The Enumeration constraint failed.
BOM is not valid.
Validating XML BOM...
BOM validated successfully.
```
The reported issue during validation is already reported here as separate [ticket](https://github.com/CycloneDX/cyclonedx-cli/issues/220) and located higher in the SBOM file than this one, so 2 cases possible:
- Validate command fails on 1st issue and doesn't validate rest of the file at all
- Validate command doesn't detect this case as issue, while merge command fails to process it
Contributor guide
Assessment
This issue has not been assessed yet.