CycloneDX / CycloneDX/cyclonedx-web-tool

Conversion of SBOM in XML or JSON format with two licenes creates a wrong JSON or XML SBOM

Open
#127 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
49
Forks
10
PR merge metrics
No merged PRs in 30d

Description

I copied the example of https://cyclonedx.org/use-cases/#openchain-conformance in an XML and a JSON file (see "CycloneDX - OpenChain conformance.xml" and "CycloneDX - OpenChain conformance.json" in the ZIP file). I'm validated both and there are valid SBOM files.

If I convert the XML file with this tool to JSON then the file is valid but the second license ("LGPL-2.1-only") in evidence is missing (see "CycloneDX - OpenChain conformance - Converted.json" in the ZIP file).

If I convert the JSON file with this tool to XML then the file is an invalid SBOM file (see "CycloneDX - OpenChain conformance - Converted.xm"l in the ZIP file). I got the message "Validation failed at line number 24 and position 10: The element 'evidence' in namespace 'http://cyclonedx.org/schema/bom/1.5' has invalid child element 'licenses' in namespace 'http://cyclonedx.org/schema/bom/1.5'. List of possible elements expected: 'copyright' in namespace 'http://cyclonedx.org/schema/bom/1.5' as well as any element in namespace '##other'. "
[CycloneDX - OpenChain conformance.zip](https://github.com/CycloneDX/cyclonedx-web-tool/files/13214485/CycloneDX.-.OpenChain.conformance.zip)

Contributor guide

Open the contributing guide

Research direction

Start with the XML and JSON fixtures in “CycloneDX - OpenChain conformance.zip”, along with the converted JSON and XML outputs. Reproduce both conversion directions and validate the results; done means both licenses in evidence are preserved and the converted SBOMs validate successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
json, xml
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.