Closed llaville closed 9 months ago
Node vs Docker (1-0) :)
time cdxgen -t php -o bom.json
real 0m1.106s
user 0m1.270s
sys 0m0.110s
time docker run --rm -it -v /tmp:/tmp -v $(pwd):/app:rw ghcr.io/cyclonedx/cdxgen -r /app -t php -o bom.json
real 0m2.558s
user 0m0.104s
sys 0m0.124s
FYI: there is dupplicated option -t
(with -it
) in docker usage on README page that should be remove:
https://github.com/CycloneDX/cdxgen/blame/v8.0.4/README.md#L81
@llaville, In docker invocation, could you try with -o /app/bom.json
as shown in the readme. Without /app it would try to write to its current directory, which would be inside the container image.
@prabhu I suggest to use another syntax (with the -w
docker run option to specify working directory)
docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t -w /app ghcr.io/cyclonedx/cdxg
en -r /app -o bom.json
BTW, whatever you specify -o bom.json
, both files bom.json
and bom.xml
are generated.
We suppose to have only one file depending of the invocation (JON or XML). Does it make sense for you ?
NOTE for those that want to add a WORKDIR
directive in your Dockerfile, I recommend to read https://docs.github.com/en/actions/creating-actions/dockerfile-support-for-github-actions#workdir
@llaville Both files are generated for legacy reasons. I hope one day we can get rid of XML and simplify the codebase.
@prabhu I don't understand, as both versions (JON and XML) may be generated, why you can't just write the specific file version asked by final user. Otherwise the -o
is almost useless because results on standard output is difficult to handle.
@llaville, we have some large enterprise users using cdxgen that are incorrectly invoking the tool and consuming either xml or json files. Don't want to break the internet yet. Perhaps, v9 could only support json output, thus avoiding this problem completely. Also we can default to a file like bom.json and not use console output which is currently the default.
@prabhu Consider what in my opinion a software like cdxgen should do !
cdxgen -o bom.xml
cdxgen -o bom.json
cdxgen -o bom.xml -o bom.json
I know that each software has its history, and wrong entreprise users usage, but each lead developer is suppose to improve quality !
Thanks @llaville. Couldn't agree more.
Hello
Related to my previous issue report #236 on a PHP project, I would like here to highlight the
-o | --output
issue with Docker distribution.As I've already said in report 236, this option did not produced any results. So to confirm that it was only with Docker, I've install cdxgen (latest version 8.0.4) with npm.
Then on a local copy (git clone) of my PHP project (https://github.com/llaville/box-manifest), I've run following commands :
that gave following output:
And last check that previous files does not exists:
that gave following output:
Finally, run:
that gave following results:
NOTE both versions were produced, while I've only asked for json, but it's better than Docker version that produce nothing ;-)
NOTE I'm also surprised by files size. XML is supposed to be more verbose than JSON, but here it's the opposite !