CycloneDX / CycloneDX/cyclonedx-cli
Xml validation failure after merge using cyclonedx-cli
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
when creating SBOMS using cyclonedx in powershell for example
dotnet CycloneDX example.sln ^
--spec-version 1.6 ^
--output-format xml ^
-o .
and then merging using cyclonedx-cli via
& .\cyclonedx-win-x64.exe merge `
--input-files "example.xml" "example2.xml" "example3.xml" `
--output-file "merged.xml" `
--output-format xml `
--output-version v1_6
validating merged.xml with
.\cyclonedx-win-x64.exe validate --input-file .\merged.xml --input-format xml --input-version v1_6 --fail-on-errors
results in the error
Validation failed at line number 12 and position 8: The element 'tools' in namespace 'http://cyclonedx.org/schema/bom/1.6' has invalid child element 'components' in namespace 'http://cyclonedx.org/schema/bom/1.6'. List of possible elements expected: 'tool' in namespace 'http://cyclonedx.org/schema/bom/1.6'.
BOM is not valid.
even though each individual SBOM being merged passes validation.
I believe this is due to the schema 1.6 not being applied properly but just a guess!
note: cyclonedx version 5.5.0, cyclonedx-cli version 0.29.1
Thanks in advance!
Contributor guide
Assessment
This issue has not been assessed yet.