Command fails to run about mdbom HOT 6 OPEN

I haven't really looked into this particular case. But, from memory, there's a bunch of older packages on nuget that don't supply license information. Or maybe it isn't well structured. Looks like that might be the problem with parsing here. So the CycloneDX .NET tool sometimes generates what is technically not a valid BOM.

@HaRo87 I see that you are using the pypi and npm options to generate a URL to the relevant package repository page.

All the CycloneDX implementations should be populating package URLs for components. Maybe that could be used to determine the type at the component level instead of the BOM level? That would be especially useful for polyglot applications that might have, for example, npm packages for the front end and something else for the back end.

Another option, is that the relevant URLs could be populated by the CycloneDX tooling as an external reference for each component. Then you could just include that and shouldn't need any special ecosystem specific handling.

from mdbom.

@HaRo87, yes this is the very first time. New to this kind of tool, and didn't clearly understand that information on the site. The company I work for mainly develops in .Net (and C/C++), so I don't have anything in python or npm to scan with one of the CycloneDX tools.
Was more looking into your tool to see if I could utilize it somewhere in the SBOM process we are developing

from mdbom.

Thanks @huntantr for your bug report. I just stumbled on the same issue. There were some recent changes in cyclonedx-py which broke the format. I will have a closer look. For the time being you can pin cyclonedx-py to 0.4.3 which is supported by mdbom.

And sorry for the late reply!

from mdbom.

I am actually using cyclonedx-dotnet to generate my sbom. Is there a different version of it that I should use?

from mdbom.

Ah, interesting. Did that ever work for you, or did you try MdBOM for the first time? Because I state here that it currently supports pypi anf npm. No .NET support at this time. That would be a new feature request. 😉

from mdbom.

Hi @huntantr,
sorry that it was silent for so long but I did not manage to find any time working on MdBOM for quite some time. I've done some changes and could now implement the dotnet compatibility. If you're still interested it would be nice to get a sample BOM as JSON from the dotnet ecosystem. I am not a dotnet developer and thus do not have any setup.

from mdbom.