CycloneDX / CycloneDX/cyclonedx-cli

Xml validation failure after merge using cyclonedx-cli

Open
#468 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

when creating SBOMS using cyclonedx in powershell for example

dotnet CycloneDX example.sln ^
--spec-version 1.6 ^
--output-format xml ^
-o .

and then merging using cyclonedx-cli via

& .\cyclonedx-win-x64.exe merge `
--input-files "example.xml" "example2.xml" "example3.xml" `
--output-file "merged.xml" `
--output-format xml `
--output-version v1_6

validating merged.xml with

.\cyclonedx-win-x64.exe validate --input-file .\merged.xml --input-format xml --input-version v1_6 --fail-on-errors

results in the error

Validation failed at line number 12 and position 8: The element 'tools' in namespace 'http://cyclonedx.org/schema/bom/1.6' has invalid child element 'components' in namespace 'http://cyclonedx.org/schema/bom/1.6'. List of possible elements expected: 'tool' in namespace 'http://cyclonedx.org/schema/bom/1.6'.
BOM is not valid.

even though each individual SBOM being merged passes validation.

I believe this is due to the schema 1.6 not being applied properly but just a guess!

note: cyclonedx version 5.5.0, cyclonedx-cli version 0.29.1

Thanks in advance!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.