devops-kung-fu / devops-kung-fu/bomber
Bomber is not finding packages in a SBOM file that has been converted using the CycloneDX Convert function
- Dominant language
- Go
- Stars
- 624
- Forks
- 56
- PR merge metrics
- No merged PRs in 30d
Description
The problem I am having is that bomber does NOT find any packages in a SBOM that has been converted by the cyclonedx-node covert process. The SBOM is generated from a javascript application.
To recreate for testing:
Create a CycloneDX SBOM in JSON format:
``` cyclonedx-node --output bomber-test.json ```
If we scan that SBOM with Bomber, it works:

Now convert that CycloneDX SBOM to SPDX using the cyclonedx convert function:
``` cat ./bomber-test.json | cyclonedx convert --input-format json --output-format spdxjson > ./converted-to-spdx.json ```
Now that you have a freshly converted SPDX format SBOM, run Bomber against it:
``` bomber scan ./converted-to-spdx.json ```
Unfortunately, Bomber doesn't find any packages even thought there are many components listed in the converted SBOM:

I'm attaching all files here so you can inspect them.
[bomber-files.zip](https://github.com/devops-kung-fu/bomber/files/12236510/bomber-files.zip)
Contributor guide
Assessment
This issue has not been assessed yet.