Comments (8)
Second example. I ran this on an SBOM with 9928 components. There were duplicate components.
1. Type: [unique], Field: [components], Description: [array items[3,243] must be unique]
Failing object: [[
{
"name": "acl",
"publisher": "Guillem Jover <guillem@ ... (truncated)
The message is correct, components[3]
and components[243]
were duplicates. However, the "failing object" is truncated to show components[0]
. But it wasn't related to the message. It would be much easier to read the message if the message showed components[3] instead of components[0].
from sbom-utility.
Hi @esnible, Let me try and respond to your comments...
the error seems to be coming from validation in resources/schema/cyclonedx/1.2/bom-1.2-strict.schema.json, not resources/schema/cyclonedx/1.2/bom-1.2.schema.json.
The non-strict CDX v1.2 JSON schema does enforce the "OneOf" constraint for "license" (not just in strict):
In fact, the "strict" schema, if a "diff" is performed, typically only adds the "additionalProperties": false,
property to almost every type definition (which prevents any non-standard fields).
The message is correct, components[3] and components[243] were duplicates. However, the "failing object" is truncated to show components[0]. But it wasn't related to the message. It would be much easier to read the message if the message showed components[3] instead of components[0].
Unfortunately, the schema error results processing code only reports at the granularity of the owning object, in this case an array
. In this case, it is enforcing a "uniqueness"
constraint within the entirety of the array.
If you would like to add special logic as a pull request to look for this specific error case (i.e., array uniqueness) and post-process the error results to reduce the result set reported (as you likely did manually after using debug
option) I would welcome that.
Otherwise, please update the title to limit the request to that specific enhancement (and ack. that the "v1.2" / strict issue) is not the enhancement being requested...
If you do submit a PR, please reference this issue.
from sbom-utility.
@esnible I was wondering why your tooling was still using an outdated version of the .NET tool:
"tools": [{
"vendor": "CycloneDX",
"name": "CycloneDX module for .NET",
"version": "1.6.1.0"
}
which was from June 27, 2021 (https://github.com/CycloneDX/cyclonedx-dotnet/releases/tag/v1.6.1).
as I see that the latest version is 2.7:
I would imagine that the newer version would support v1.3 at the very least, but expect it to support v1.4 which has been out for some time and v1.5 will be released GA in a few weeks.
from sbom-utility.
BTW, I almost missed your last question...
It isn't clear to me what is wrong with this license:
"licenses": [
{
"license": {
"url": "https://github.com/AngleSharp/AngleSharp/blob/master/LICENSE"
}
}
],
The answer is simple looking at the schema for "license":
"license": {
"type": "object",
"title": "License Object",
"oneOf": [
{
"required": ["id"]
},
{
"required": ["name"]
}
],
you need to provide one of the required fields... either id
or name
(as url
is an optional field). Preferably you would supply an id
which would be an actual SPDX ID (identifier).
from sbom-utility.
@esnible I may ask you to close this issue and then create a new one solely for the "enhancement" to the "array error result processing" so that when a developer works on it, it is disentangled from the other questions/issues surfaced here.
Would that be possible? You can ref. this issue for history...
from sbom-utility.
@esnible I was wondering why your tooling was still using an outdated version of the .NET tool:
I created this issue after I received a proprietary SBOM with 37562 components, but only 5812 unique components. I couldn't attach the proprietary SBOM, but saw a similar error in the public github.com/chainguard-dev/bom-shelter repo. I am not using the old tooling myself.
It might be better if you created the "array result processing enhancement" Issue. I know what I want to see but I don't know how to express it within the schema validation terminology.
When I see a message saying I have "64440 errors" in my SBOM, my wish is that "having duplicates" would be displayed as one error, not as a unique error for every duplicate pair. The large number of duplicate pair errors make it hard to see if any other errors besides duplication are present.
from sbom-utility.
@esnible I understand your intent and will try to open a new issue and ref. this one... however, this will require IMO a new "special processing" path (with new flags to enable/disable) and require some considered thought to only collapse/condense when it can be certain they are the same error. However, having this many errors (esp. duplicates is NOT normal).
In any event, the tool developer should not be producing duplicates (invalid SBOMs) and hopefully you are opening an issue against them as they are clearly not validating their output at all!
from sbom-utility.
Saved the enhancement request in a separate issue #37
from sbom-utility.
Related Issues (20)
- signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x5f53ae
- Enhancement: Add option to skip license validation
- Documentation for custom.json HOT 3
- Support stdin for input HOT 1
- Include config.json and licenses.json in the compiled executable HOT 2
- Support Graph rendering of dependences and formatted (graph) output
- Testcase: Need test for new complex "licenseChoice" schema defn. HOT 1
- Create Microsoft Softare Installer (MSI) file for Windows
- Testcase: Need new test case for new "Creation Tools" object
- Release v013.0 is missing release assets HOT 2
- Testcase: Need testcase that has a CDXService with no "bom-ref"
- Support OWASP SCVS "Profiles" for use in validation, trimming, etc. commands
- `diff` panics while diffing two files HOT 9
- SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x104bfa024
- Feature Request - Generate JSON with entire structure
- TODO: Change Formulation and ModelCard schemas to use pointers HOT 2
- Support SPDX in the "patch" command
- Add support for "legacy" and new `Tool` structure introduced in CycloneDX v1.5 HOT 1
- Support for both the v1.5 component evidence `identity` and the v1.6 array of `componentIdentityEvidence` HOT 2
- Add Apache Skywalking-eyes license checking to GitHub action CI workflow HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sbom-utility.