aboutcode-org / aboutcode-org/scancode.io
Parts of the latest CycloneDX specs (1.5, 1.6) are not supported by `cyclonedx-python-lib`
Ouverte
- Langage dominant
- Python
- Étoiles
- 215
- Forks
- 203
- Merge moyen
- 4 j 8 h
- PR mergées (30 j)
- 6
Description
For example, the `metadata.tools` as an array was deprecated in 1.5 and replaced by an object structure where you can define a list of `components` and `services`.
The issue is that the new structure is not supported by the `cyclonedx-python-lib`, neither for serialization (output) nor deserialization (input).
It can be in the way of loading a SBOM that is valid regarding the spec, but fails the deserialization.
https://github.com/CycloneDX/cyclonedx-python-lib/issues/561#issuecomment-1972673735
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.