CycloneDX / CycloneDX/cyclonedx-web-tool
Conversion of SBOM in XML or JSON format with two licenes creates a wrong JSON or XML SBOM
- Dominant language
- HTML
- Stars
- 49
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
I copied the example of https://cyclonedx.org/use-cases/#openchain-conformance in an XML and a JSON file (see "CycloneDX - OpenChain conformance.xml" and "CycloneDX - OpenChain conformance.json" in the ZIP file). I'm validated both and there are valid SBOM files.
If I convert the XML file with this tool to JSON then the file is valid but the second license ("LGPL-2.1-only") in evidence is missing (see "CycloneDX - OpenChain conformance - Converted.json" in the ZIP file).
If I convert the JSON file with this tool to XML then the file is an invalid SBOM file (see "CycloneDX - OpenChain conformance - Converted.xm"l in the ZIP file). I got the message "Validation failed at line number 24 and position 10: The element 'evidence' in namespace 'http://cyclonedx.org/schema/bom/1.5' has invalid child element 'licenses' in namespace 'http://cyclonedx.org/schema/bom/1.5'. List of possible elements expected: 'copyright' in namespace 'http://cyclonedx.org/schema/bom/1.5' as well as any element in namespace '##other'. "
[CycloneDX - OpenChain conformance.zip](https://github.com/CycloneDX/cyclonedx-web-tool/files/13214485/CycloneDX.-.OpenChain.conformance.zip)
Contributor guide
Research direction
Start with the XML and JSON fixtures in “CycloneDX - OpenChain conformance.zip”, along with the converted JSON and XML outputs. Reproduce both conversion directions and validate the results; done means both licenses in evidence are preserved and the converted SBOMs validate successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json, xml
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100