CycloneDX / CycloneDX/specification

Change component type so that it's not required or add a new type of unassigned

Open
#466 7 comments 0 reactions 0 assignees View on GitHub
proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

I'm currently working on generating SBOM for a yocto based embedded distribution and I'd like to use dependency-track. I have a semi-working solution to get my SBOM into dependency track but it's not perfect and so I've been looking at generating validated cycloneDX formatted json with the new solution I'm working on.

However after experimenting with cyclonedx-python-lib and it's validation functions I've discovered that component type is a required field:
https://cyclonedx.org/docs/1.6/json/#components_items_type

Yocto has a lot of packages (over 100 just in the initramfs, never mind the root fs) that I need to cover and I can't find a way to easily extract a reasonable type for each package. Is there an explanation for why this is required when it doesn't appear to be used by applications like dependency track? Could the required status be dropped?

If there is a specific reason to keep this as a required field, could an extra type of 'unassigned' or similar be added to the spec?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.