aboutcode-org / aboutcode-org/scancode-toolkit

Dependencies for maven project only resolved for cyclonedx, not for spdx/json

Abierto
#2,854 4 comentarios 0 reacciones 0 asignados Ver en GitHub
bug
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

### Description

Dependencies/Packages from a maven pom.xml are only detected when outputting to cyclone-dx-xml, but not when outputting to json or spdx-tv or spdx-xml.

Im not sure if this is a missing feature that is only implemented in cyclonedx or a bug?

### How To Reproduce

I created a Hello-World-Style java project with the following dependency included in pom.xml

```xml


log4j
log4j
1.2.17

```
Running scancode like so:

```bash
scancode -clpieu --spdx-tv ../../scancode-java.spdx.tv ../../Log4J-example-with-java --max-depth 0 --consolidate
```

Yields an SBOM which only includes "Files" and the main Package

```
# Package

PackageName: log4j_example_with_java
SPDXID: SPDXRef-001
PackageDownloadLocation: NOASSERTION
PackageVerificationCode: daf7c31358a7967f856b9a0eda8bee2f61abde16
PackageLicenseDeclared: NOASSERTION
PackageLicenseConcluded: NOASSERTION
PackageLicenseInfoFromFiles: NONE
PackageCopyrightText: NONE

# File
FileName: ./Log4J-example-with-java/.idea/compiler.xml
SPDXID: SPDXRef-6
FileChecksum: SHA1: 5deee417bc8e462aa80f979e9fb353f707df9b1f
LicenseConcluded: NOASSERTION
LicenseInfoInFile: NONE
FileCopyrightText: NONE

# ...
```

Same goes for the JSON output.

CycloneDX however correctly includes the log4j dependency:

```bash
scancode -clpieu --cyclonedx ../../scancode-java.json.cdx ../../Log4J-example-with-java --max-depth 0 --consolidate
```

```xml




```

### System configuration

5.13.0-27-generic #29-Ubuntu SMP Wed Jan 12 17:36:47 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

ScanCode version 30.1.0

ScanCode Output Format version 2.0.0

SPDX License list version 3.15

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.