CycloneDX / CycloneDX/cyclonedx-gomod
Indirect dependencies not added BOM file while generation BOM using Cyclonedx
Open
question
- Dominant language
- Go
- Stars
- 187
- Forks
- 40
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
I used cyclonedx-gomod to generate a BOM file, but some internal dependencies were not included. Although most indirect dependencies were added, the following two were not:
github.com/stretchr/objx v0.5.0 (indirect)
google.golang.org/appengine v1.6.7 (indirect)
Contributor guide
Research direction
Start by reproducing the BOM generated by cyclonedx-gomod for a Go module containing github.com/stretchr/objx v0.5.0 and google.golang.org/appengine v1.6.7. Compare the module dependency data with the generated BOM and verify that both indirect dependencies appear when the issue is fixed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100