Coverting CycloneDXjson to CycloneDXjson loses external references
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 962
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
What happened:
When using the convert feature, converting from CycloneDX json to CycloneDX json (the same format) loses the external references.
What you expected to happen:
Converting between the same format should result in the same output as input.
Steps to reproduce the issue:
Pass a cycloneDX json file to the convert feature: "syft convert cyclonedx-file.json -o cyclonedx-json=outputfile.json"
Anything else we need to know?:
Environment:
- Output of
syft version: syft 0.83.0 - OS (e.g:
cat /etc/os-releaseor similar): Ubuntu 20.04.5 LTS
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the syft convert command and its CycloneDX JSON input and output handling. Reproduce the conversion with a file containing external references, then trace where those references are dropped; done means converting CycloneDX JSON to CycloneDX JSON preserves the input references.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100