DependencyTrack / DependencyTrack/dependency-track
sbom merged with cyclonedx-cli does not get imported
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
After merging several bom.xml into a sbom.xml with cyclonedx-cli, Dependency Track seems to not process it.
I get no errors when uploading it and nothing really happens.
If instead I upload separately the bom.xml that I merged they get processed.
### Steps to Reproduce:
Merge the bom.xml files into one:
`docker run -v /home/all_bom_files:/tmp cyclonedx/cyclonedx-cli merge --input-format xml --input-files /tmp/bom_1.xml /tmp/bom_2.xml --output-file /tmp/bom_merged.xml`
Upload the file into Dependecy Track project.
### Expected Behavior:
Components and dependecies to be recognized.
### Environment:
- Dependency-Track Version: v4.3.6
- Distribution: Docker
- BOM Format & Version: XML format, CycloneDX Maven plugin v2.5.3
- Database Server: PostgreSQL
- Browser: Firefox
### Additional Details:
None
Contributor guide
Assessment
This issue has not been assessed yet.