CycloneDX / CycloneDX/cyclonedx-cli

Unable to Validate CycloneDX Format Versions 1.5 and 1.6 with ModelCard and Data Elements

Open
#403 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

The latest release of the CycloneDX CLI tool is unable to validate SBOMs conforming to CycloneDX format versions 1.5 and 1.6 that include the modelCard and data elements. These versions of the format introduce new features and structures, such as the modelCard and data elements, which are not being properly recognized or validated by the CLI tool.
The validation fails even though the SBOM adheres to the CycloneDX specification

[Link to the CycloneDX 1.5 modelCard](https://cyclonedx.org/docs/1.5/json/#components_items_modelCard)
[Link to the CycloneDX 1.5 data](https://cyclonedx.org/docs/1.5/json/#components_items_data)
[Link to the CycloneDX 1.6 modelCard](https://cyclonedx.org/docs/1.6/json/#components_items_modelCard)
[Link to the CycloneDX 1.6 data](https://cyclonedx.org/docs/1.6/json/#components_items_data)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.