CycloneDX / CycloneDX/cyclonedx-cli

Merging SBOMs doesn’t get rid of duplicates

Open
#356 10 comments 6 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

I have a Gradle multi-project build, in which i generate an SBOM for java dependencies for each project using the [CycloneDX Gradle](https://github.com/CycloneDX/cyclonedx-gradle-plugin) plugin. I want to merge all the existing SBOMs, however the resulting SBOM doesn’t get rid of duplicated dependencies.

# Steps to reproduce

- Create a build with two sub-projects.

## dependencies for the first project

```jsx
dependencies {
implementation("org.apache.commons:commons-lang3:3.12.0")
}
```

## dependencies for the second project

```jsx
dependencies {
implementation("org.apache.commons:commons-lang3:3.12.0")
implementation("com.fasterxml.jackson.core:jackson-databind:2.15.3")
}
```

- Apply the CycloneDX Gradle plugin for each project

```jsx
tasks.cyclonedxBom {
setProjectType("application")
setSchemaVersion("1.5")
setDestination(project.file("build/reports"))
setOutputName("bom2")
setOutputFormat("json")
setIncludeBomSerialNumber(false)
setIncludeLicenseText(true)
setComponentVersion("2.0.0")
}
```

- Generate an SBOM for each project
- Use the cyclonedx-cli `merge` command to merge the two SBOMs

CycloneDX cli version: 0.25.0 `0.25.0`

CycloneDX Gradle plugin version: `1.7.4`

# Expected behavior

although the commons-lang3 dependency is defined in both projects, I only want it to be declared in the final SBOM once.

# Current behavior

the current SBOM declares the commons-lang3 dependency twice.

```jsx
"dependencies": [
{
"ref": "pkg:maven/org.apache.commons/commons-lang3@3.12.0?type=jar",
"dependsOn": []
},
{
"ref": "pkg:maven/org.example/app1@1.0-SNAPSHOT?type=jar",
"dependsOn": [
"pkg:maven/org.apache.commons/commons-lang3@3.12.0?type=jar"
]
},
{
"ref": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.15.3?type=jar",
"dependsOn": []
},
{
"ref": "pkg:maven/org.apache.commons/commons-lang3@3.12.0?type=jar",
"dependsOn": []
},
{
"ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3?type=jar",
"dependsOn": [
"pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.15.3?type=jar",
"pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3?type=jar"
]
},
{
"ref": "pkg:maven/org.example/app2@1.0-SNAPSHOT?type=jar",
"dependsOn": [
"pkg:maven/org.apache.commons/commons-lang3@3.12.0?type=jar",
"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3?type=jar"
]
},
{
"ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3?type=jar",
"dependsOn": []
}
]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.