CycloneDX / CycloneDX/cyclonedx-dotnet-library
Flatmerge clobbers metadata.component
- Dominant language
- C#
- Stars
- 28
- Forks
- 35
- PR merge metrics
- No merged PRs in 30d
Description
Flatmerge clobbers metadata.component when the new metadata is initiated and the only sub-element that persists is metadata.tool.
https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/b5fbaf66e4fcae632950744f66b7f37e41e2dcb3/src/CycloneDX.Utils/Merge.cs#L62
If you can advise on how this should be handled, I'm happy to create a pull request with the change. Possibly, convert metadata.component to a List and then merge like metadata.tool?
This bug is linked to the following issues
#https://github.com/CycloneDX/cyclonedx-cli/issues/218
#https://github.com/CycloneDX/cyclonedx-cli/issues/219
Contributor guide
Research direction
Start in src/CycloneDX.Utils/Merge.cs at line 62, where the metadata merge is reported to replace metadata.component while retaining metadata.tool. Review the linked cyclonedx-cli issues for the expected behavior, then verify that the chosen merge behavior preserves the intended metadata.component and metadata.tool values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100