You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The problem I am having is that bomber does NOT find any packages in a SBOM that has been converted by the cyclonedx-node covert process. The SBOM is generated from a javascript application.
To recreate for testing:
Create a CycloneDX SBOM in JSON format: cyclonedx-node --output bomber-test.json
If we scan that SBOM with Bomber, it works:
Now convert that CycloneDX SBOM to SPDX using the cyclonedx convert function: cat ./bomber-test.json | cyclonedx convert --input-format json --output-format spdxjson > ./converted-to-spdx.json
Now that you have a freshly converted SPDX format SBOM, run Bomber against it: bomber scan ./converted-to-spdx.json
Unfortunately, Bomber doesn't find any packages even thought there are many components listed in the converted SBOM:
I'm attaching all files here so you can inspect them. bomber-files.zip
The text was updated successfully, but these errors were encountered:
Just touching this issue again. @mirxcle note that this is an SPDX file. I'd bet the schema isn't compatible with Bomber so we'll have to see if there's a half decent SPDX go module we can use rather than have to roll our own.
The problem I am having is that bomber does NOT find any packages in a SBOM that has been converted by the cyclonedx-node covert process. The SBOM is generated from a javascript application.
To recreate for testing:
Create a CycloneDX SBOM in JSON format:
cyclonedx-node --output bomber-test.json
If we scan that SBOM with Bomber, it works:
Now convert that CycloneDX SBOM to SPDX using the cyclonedx convert function:
cat ./bomber-test.json | cyclonedx convert --input-format json --output-format spdxjson > ./converted-to-spdx.json
Now that you have a freshly converted SPDX format SBOM, run Bomber against it:
bomber scan ./converted-to-spdx.json
Unfortunately, Bomber doesn't find any packages even thought there are many components listed in the converted SBOM:
I'm attaching all files here so you can inspect them.
bomber-files.zip
The text was updated successfully, but these errors were encountered: