cyclonedx merge command does not support v1.6 format

[ferben]

When you try merge two files in 1.6 version, you get:

Unhandled exception: System.ArgumentException: Unsupported specification version: 1.6
   at CycloneDX.Models.Bom.set_SpecVersionString(String value)
...

cyclonedx-merge-stacktrace.txt

[candrews]

Do you have any estimate as to when cyclonedx 1.6 support will be available?

Thank you!

[candrews]

Trivy 0.5.3 (see aquasecurity/trivy#6902) produces CycloneDX 1.6, meaning that this tool doesn't work with the latest version of Trivy.

[Radial01]

I'd also like to find out if there's any ETA as to when we could expect CycloneDX 1.6 to be supported? Thanks!

[mtsfoni]

Depends.
If nobody beats me to it might be end of August/start of September.
I started once and stumbled over some tech debt, some of that has been fixed by other contributes by now.

As the CLI just consumes the library, here is the right issue regarding 1.6: CycloneDX/cyclonedx-dotnet-library#284

[mtsfoni]

Just released version 0.27.0 that should now support CycloneDX 1.6

[wkoot]

Confirmed that cyclonedx-cli merge can now process files adhering to "specVersion": "1.6" without throwing an error.
I tested this on a bunch of containers with aquasec/trivy:0.55.1 and cyclonedx/cyclonedx-cli:0.27.0.

[wkoot]

Although listed as supported, the files produced do not adhere to spec - see #409 and #399
In both cases there is no error logged by cyclonedx-cli, but the output file is not valid

[hughsaunders]

We're seeing merge adding "data": [], to components which causes errors when trying to parse the combined bom.

Example Component:

          "type": "library",
          "authors": [],
          "name": "cucumber-html-formatter",
          "version": "17.0.0",
          "description": "cucumber-html-formatter-17.0.0",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "b218c9a89ea2ef020e0cb36cb856a09c0ceb7e9b0507bdb58050aafa7f53a7c1"
            }
          ],
          "licenses": [
            {
              "license": {
                "id": "MIT",
                "properties": []
              }
            }
          ],
          "purl": "pkg:gem/cucumber-html-formatter@17.0.0",
          "omniborId": [],
          "swhid": [],
          "properties": [
            {
              "name": "gem",
              "value": "https://rubygems.org/"
            }
          ],
          "data": [],
          "tags": []
        },

Example Error:

 json: cannot unmarshal array into Go struct field Component.components.components.data of type cyclonedx.ComponentData

The combined bom can be fixed with jq but this is not ideal.

jq 'walk(if type == "object" and has("data") and (.data == []) then .data = null else . end)' combined-com.json > combined-bom-fixed.json

[andreas-hilti]

@hughsaunders To me this sounds like two independent issues, which should be filed separately.
First of all, it sounds like

 json: cannot unmarshal array into Go struct field Component.components.components.data of type cyclonedx.ComponentData

the Go implementation doesn't expect component.data to be an array (compare https://cyclonedx.org/docs/1.6/json/#components_items_data).

Second, the cli (or the underlying cyclonedx-dotnet-library) doesn't distinguish very well between empty lists and non-existing lists, which then leads to a violation of

This object SHOULD be specified for any component of type data and must not be specified for other component types.

I believe this particular case could be fixed by adding
public bool ShouldSerializeData() { return Data?.Count > 0; }
in Component (https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/main/src/CycloneDX.Core/Models/Component.cs).

[andreas-hilti]

@hughsaunders Can you please provide more details? Are you using xml as input files?

I have tried to merge sbom1.json and sbom2.json from the test resources, but this doesn't add any additional "data" members.
Only if I use sbom1.xml and sbom2.xml from the test resources, additional "data" members are added.

[hughsaunders]

@andreas-hilti Hey thanks, the unmarshal error I posted is from an internal tool, but it uses the cyclonedx-go's decoder.
Your fix looks sensible to me, don't add the data field if there's no data to add. Added an approval though it doesn't count.

Regarding JSON vs XML, most of the generated BOMs are JSON, but for some reason the ruby BOM is generated as XML, then all the BOMs are merged to a final JSON BOM.

I agree regarding the go vs spec issue and went to look in the cyclonedx-go repo and its already been reported :) CycloneDX/cyclonedx-go#196. There's also a PR which your review on may help things: https://github.com/CycloneDX/cyclonedx-go/pull/197/files

[bedla]

related issue CycloneDX/cyclonedx-go#236