CycloneDX / CycloneDX/cyclonedx-cli
Documention: Hierarchical merge metadata requirement
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
The documention states:
> Note: To perform a hierarchical merge all BOMs need the subject of the BOM described in the metadata component element.
There are no details here as to what this should look like.
When I go to the Python command cyclonedx-bom, I don't see any options for adding this:
```bash
usage: cyclonedx-bom [-h] (-c | -cj | -e | -p | -pip | -r) [-i FILE_PATH] [--format {xml,json}] [--schema-version {1.4,1.3,1.2,1.1,1.0}] [-o FILE_PATH] [-F] [-pb] [-X]
CycloneDX SBOM Generator
options:
-h, --help show this help message and exit
-c, --conda Build a SBOM based on the output from `conda list --explicit` or `conda list --explicit --md5`
-cj, --conda-json Build a SBOM based on the output from `conda list --json`
-e, --e, --environment
Build a SBOM based on the packages installed in your current Python environment (default)
-p, --p, --poetry Build a SBOM based on a Poetry poetry.lock's contents. Use with -i to specify absolute path to a `poetry.lock` you wish to use, else we'll look for one in the current working directory.
-pip, --pip Build a SBOM based on a PipEnv Pipfile.lock's contents. Use with -i to specify absolute path to a `Pipfile.lock` you wish to use, else we'll look for one in the current working directory.
-r, --r, --requirements
Build a SBOM based on a requirements.txt's contents. Use with -i to specify absolute path to a `requirements.txt` you wish to use, else we'll look for one in the current working directory.
-X Enable debug output
Input Method:
Flags to determine how this tool obtains it's input
-i FILE_PATH, --in-file FILE_PATH
File to read input from. Use "-" to read from STDIN.
SBOM Output Configuration:
Choose the output format and schema version
--format {xml,json} The output format for your SBOM (default: xml)
--schema-version {1.4,1.3,1.2,1.1,1.0}
The CycloneDX schema version for your SBOM (default: 1.4)
-o FILE_PATH, --o FILE_PATH, --output FILE_PATH
Output file path for your SBOM (set to '-' to output to STDOUT)
-F, --force If outputting to a file and the stated file already exists, it will be overwritten.
-pb, --purl-bom-ref Use a component's PURL for the bom-ref value, instead of a random UUID
```
Same with the Node equivalent, @cyclonedx/cyclondedx-npm:
```bash
Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.
Arguments:
Path to project's manifest file. (default: "package.json" file in current working directory)
Options:
--ignore-npm-errors Whether to ignore errors of NPM.
This might be used, if "npm install" was run with "--force" or "--legacy-peer-deps". (default: false)
--package-lock-only Whether to only use the lock file, ignoring "node_modules".
This means the output will be based only on the few details in and the tree described by the "npm-shrinkwrap.json" or "package-lock.json", rather than the contents of "node_modules"
directory. (default: false)
--omit Dependency types to omit from the installation tree.(can be set multiple times) (choices: "dev", "optional", "peer", default: "dev" if the NODE_ENV environment variable is set to
"production", otherwise empty)
--flatten-components Whether to flatten the components.
This means the actual nesting of node packages is not represented in the SBOM result. (default: false)
--short-PURLs Omit all qualifiers from PackageURLs.
This causes information loss in trade of shorter PURLs, which might improve digesting these strings. (default: false)
--spec-version Which version of CycloneDX spec to use. (choices: "1.2", "1.3", "1.4", default: "1.4")
--output-reproducible Whether to go the extra mile and make the output reproducible.
This requires more resources, and might result in loss of time- and random-based-values. (env: BOM_REPRODUCIBLE)
--output-format Which output format to use. (choices: "JSON", "XML", default: "JSON")
--output-file Path to the output file.
Set to "-" to write to STDOUT. (default: write to STDOUT)
--mc-type Type of the main component. (choices: "application", "firmware", "library", default: "application")
-V, --version output the version number
-h, --help display help for command
```
I also can't see a way in this tool to add this metadata information to an existing BOM.
Any guidance greatly appreciated. It would be good to turn it into documentation (and/or added to BOM generation tools).
Contributor guide
Assessment
This issue has not been assessed yet.