devops-kung-fu / devops-kung-fu/bomber

HTML report generation fails silently when processing entire folder containing an "empty" SBOM

Open
#208 2 comments 0 reactions 1 assignee Claimed by @djschleen View on GitHub
bug
Dominant language
Go
Stars
624
Forks
56
PR merge metrics
No merged PRs in 30d

Description

Generation of HTML report for an entire directory fails silently when the directory contains an "empty" SBOM. I'm using latest version 0.4.8 and the following invocation:
`bomber scan --debug --output html ./temp`

In temp folder I have multiple SBOMs (all json format, generated using the "CycloneDX Gradle plugin" in a multi-project gradle setup). Some of the SBOMs are from gradle projects that don't add any extra dependency, so the resulting SBOMs are "empty". As soon as Bomber encounters one of these empty SBOMs it stops processing without giving a meaningful error message. Also --debug output doesn't expose any useful information. When I remove all the "empty" SBOMs, Bomber works correctly.

An example of an "empty" SBOM :
```
{
"bomFormat" : "CycloneDX",
"specVersion" : "1.5",
"serialNumber" : "urn:uuid:339661e5-161c-4261-ae90-39e54cb9cd95",
"version" : 1,
"metadata" : {
"timestamp" : "2024-03-12T21:07:08Z",
"tools" : [
{
"vendor" : "CycloneDX",
"name" : "cyclonedx-gradle-plugin",
"version" : "1.8.2"
}
],
"component" : {
"group" : "xxxxxxx.xxx",
"name" : "mailReceiver",
"version" : "LOCAL-BUILD-SNAPSHOT",
"purl" : "pkg:maven/xxxxxxx.xxx/mailReceiver@LOCAL-BUILD-SNAPSHOT?type=jar",
"type" : "library",
"bom-ref" : "pkg:maven/xxxxxxx.xxx/mailReceiver@LOCAL-BUILD-SNAPSHOT?type=jar"
}
},
"dependencies" : [
{
"ref" : "pkg:maven/xxxxxxx.xxx/mailReceiver@LOCAL-BUILD-SNAPSHOT?type=jar",
"dependsOn" : [ ]
}
]
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.