CycloneDX / CycloneDX/cyclonedx-cli

Validation of sbom file fails when externalReferences url is ssh from GitHub

Open
#425 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

`cyclonedx validate` fails when `metadata.component.externalReferences[0].url` is pointing to a url like this:

* `ssh://git@github.com:my-org/my-repo.git`

If I change the `:` after `github.com` to `/`, then the validation works.

I did put an issue on [cyclonedx-gradle-plugin](https://github.com/CycloneDX/cyclonedx-gradle-plugin) but according to them this is a valid format.
More information in the issue:

* https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/615

## To Reproduce

1. Set the `externalReferences[0].url` to `ssh://git@github.com:my-org/my-repo.git` like this:

bom.json:

```json
{
"bomFormat" : "CycloneDX",
"specVersion" : "1.6",
"serialNumber" : "urn:uuid:3877e445-1356-42b3-b11e-b0e2d46e87e7",
"version" : 1,
"metadata" : {
"timestamp" : "2025-05-15T09:32:44Z",
"tools" : {
"components" : [
{
"type" : "application",
"author" : "CycloneDX",
"name" : "cyclonedx-gradle-plugin",
"version" : "2.3.0"
}
],
"services" : [ ]
},
"component" : {
"type" : "application",
"externalReferences" : [
{
"type" : "vcs",
"url" : "ssh://git@github.com:my-org/my-repo.git"
}
]
},
},
...
```

3. Validate the SBOM file:

```bash
$ cyclonedx --version
0.27.2+f934c99826339cb8dbb83b439eb2c465fb253fb3

$ cyclonedx validate --input-file bom.json
Validation failed:
Value does not match format "iri-reference"
http://cyclonedx.org/schema/bom-1.6.schema.json#/properties/url/anyOf/0
On instance: /metadata/component/externalReferences/0/url:
ssh://git@github.com:my-org/my-repo.git
Value does not match format "iri-reference"
The string value is not a match for the indicated regular expression
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/bomLinkDocumentType
On instance: /metadata/component/externalReferences/0/url:
ssh://git@github.com:my-org/my-repo.git
Value does not match format "iri-reference"
The string value is not a match for the indicated regular expression
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/bomLinkElementType
On instance: /metadata/component/externalReferences/0/url:
ssh://git@github.com:my-org/my-repo.git
Unable to validate against any JSON schemas.
BOM is not valid.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.