CycloneDX / CycloneDX/cyclonedx-gomod
update created tools section to v1.6
- Dominant language
- Go
- Stars
- 187
- Forks
- 40
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
A freshly created sbom has:
```json
{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:4e6c0fc0-203b-45bf-94f8-28635de98f51",
"version": 1,
"metadata": {
"timestamp": "2024-09-23T16:51:48+02:00",
"tools": [
{
"vendor": "CycloneDX",
"name": "cyclonedx-gomod",
"version": "v1.8.0",
"hashes": [
{
"alg": "MD5",
"content": "f1451a88dd6ced4acaa8f8e8c36608db"
}
]}]}}
```
but https://cyclonedx.org/docs/1.6/json/#tab-pane_metadata_tools_oneOf_i0 says that `tools` as array is deprecated.
So the new form should be used.
Contributor guide
Research direction
Start by locating the code that serializes the SBOM metadata tools field and compare its output with the CycloneDX 1.6 metadata tools documentation linked in the issue. Update the generated JSON to use the new form, then verify that a freshly created SBOM no longer emits tools as the deprecated array form.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100