DependencyTrack / DependencyTrack/dependency-track

sbom merged with cyclonedx-cli does not get imported

Open
#1,385 5 comments 0 reactions 0 assignees View on GitHub
pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
After merging several bom.xml into a sbom.xml with cyclonedx-cli, Dependency Track seems to not process it.
I get no errors when uploading it and nothing really happens.
If instead I upload separately the bom.xml that I merged they get processed.

### Steps to Reproduce:
Merge the bom.xml files into one:
`docker run -v /home/all_bom_files:/tmp cyclonedx/cyclonedx-cli merge --input-format xml --input-files /tmp/bom_1.xml /tmp/bom_2.xml --output-file /tmp/bom_merged.xml`

Upload the file into Dependecy Track project.

### Expected Behavior:
Components and dependecies to be recognized.

### Environment:

- Dependency-Track Version: v4.3.6
- Distribution: Docker
- BOM Format & Version: XML format, CycloneDX Maven plugin v2.5.3
- Database Server: PostgreSQL
- Browser: Firefox

### Additional Details:
None

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.