CycloneDX / CycloneDX/cyclonedx-cli
False Validation of Syft/Grype SBOM
Open
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
I created an SBOM using Syft/Grype and it should have created a valid CycloneDX 1.4 SBOM. The SBOM did not adhere to the CycloneDX 1.4 schema, however the CycloneDX CLI validated it successfully regardless.
To reproduce:
https://github.com/anchore/syft
https://github.com/anchore/grype
syft nodered/node-red -o cyclonedx-xml --file bom.xml
grype sbom:bom.xml -o cyclonedx --file grype-bom.xml
cyclonedx validate --input-file grype-bom.xml
Result: Validated successfully
Expected result: Not valid
Contributor guide
Assessment
This issue has not been assessed yet.