aboutcode-org / aboutcode-org/scancode.io
CycloneDX SBOMs do not contain dependencies
- 主要言語
- Python
- スター
- 215
- フォーク
- 203
- 平均マージ
- 4日 8時間
- マージ済み PR（30日）
- 6
説明
As part of the ScanCode <=> ORT integration (see https://github.com/aboutcode-org/scancode.io/issues/1727) I tested analyzing [Mime Types 2.1.26](https://github.com/jshttp/mime-types/tree/2.1.26) as various inputs to ScanCode.io. v35.3.0 and to my surprise noticed that dependencies detected included in SPDX SBOM but not in CycloneDX SBOM. Is this expected behavior for some of ScanCode.io built-in pipelines?
| Test nr| Input | Pipeline | # Packages | # Deps | # Resources | # Deps in CycloneDX SBOMs | # Deps SPDX SBOMs |
|--|---|---|---|---|---|---|---|
|1| pkg:npm/mime-types@2.1.26 | scan_codebase | 1 | 9 | 8 | 0 | 9|
|2| pkg:npm/mime-types@2.1.26 | scan_single_package | 1 | 9 | 6 | 0 | 9 |
|3| pkg:npm/mime-types@2.1.26 | inspect_packages | 1 | 9 | 8 | 0 |9 |
|4| pkg:npm/mime-types@2.1.26 | resolve_dependencies | 2 | 27 | 8 | 0 | 27 |
|5| pkg:github/jshttp/mime-types@2.1.26 | scan_codebase | 1 | 9 | 15 | 0 | 9 |
|6| pkg:github/jshttp/mime-types@2.1.26 | scan_single_package | 1 | 9 | 12 | 0 | 9 |
|7| pkg:github/jshttp/mime-types@2.1.26 | inspect_packages | 1 | 9 | 15 | 0 | 9 |
|8| pkg:github/jshttp/mime-types@2.1.26 | resolve_dependencies | 0 | 0 | 15 | 0 | 27 |
Attached [scancode-io-tests.zip](https://github.com/user-attachments/files/22463897/scancode-io-tests.zip) contains all the ScanCode.io project files and SBOMs from my tests.
コントリビューションガイド
評価
この issue はまだ評価されていません。