Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge throws an error with CycloneDX #243

Open
gliese1337 opened this issue Aug 19, 2024 · 1 comment
Open

Merge throws an error with CycloneDX #243

gliese1337 opened this issue Aug 19, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@gliese1337
Copy link

Describe the bug
When trying to merge input SBOMs in CycloneDX format, the surfactant CLI produces and error message and no output.

To Reproduce
Steps to reproduce the behavior:

  1. run surfactant merge --input_format cyclonedx --output_format cyclonedx sbom1.json sbom2.json
  2. Observe error:
2024-08-19 14:30:21.305 | WARNING  | surfactant.infoextractors.docker_image:is_docker_scout_installed:21 - Install Docker Scout to scan containers for additional information
2024-08-19 14:30:21.458 | ERROR    | surfactant.plugin.manager:find_io_plugin:100 - No "read_sbom" plugin for format "cyclonedx" found

Expected behavior
The input SBOMs should be merged and an output SBOM produced.

System Information (please complete the following information):

  • OS: Ubuntu 22.04.4 LTS
  • Python: 3.10.12

Additional context
One of the inputs was generated with surfactant, the other with npm-sbom.

@gliese1337 gliese1337 added the bug Something isn't working label Aug 19, 2024
@nightlark
Copy link
Collaborator

Reading input SBOMs in CycloneDX (and SPDX eventually) formats is being implemented in PR #221 if you want to try it out and provide feedback. From discussion with @mws180000 and others, there are some lossy aspects to conversion between formats (including to the internal representation that is used as an intermediate format by the merge feature).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants