CycloneDX / CycloneDX/cyclonedx-gomod

update created tools section to v1.6

Open
#528 2 comments 2 reactions 0 assignees View on GitHub
enhancement good first issue
Dominant language
Go
Stars
187
Forks
40
Avg merge
1d 7h
Merged PRs (30d)
14

Description

A freshly created sbom has:

```json
{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:4e6c0fc0-203b-45bf-94f8-28635de98f51",
"version": 1,
"metadata": {
"timestamp": "2024-09-23T16:51:48+02:00",
"tools": [
{
"vendor": "CycloneDX",
"name": "cyclonedx-gomod",
"version": "v1.8.0",
"hashes": [
{
"alg": "MD5",
"content": "f1451a88dd6ced4acaa8f8e8c36608db"
}
]}]}}
```

but https://cyclonedx.org/docs/1.6/json/#tab-pane_metadata_tools_oneOf_i0 says that `tools` as array is deprecated.
So the new form should be used.

Contributor guide

Open the contributing guide

Research direction

Start by locating the code that serializes the SBOM metadata tools field and compare its output with the CycloneDX 1.6 metadata tools documentation linked in the issue. Update the generated JSON to use the new form, then verify that a freshly created SBOM no longer emits tools as the deprecated array form.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.