search

CycloneDX / cdxgen

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server. Discord: https://discord.gg/DP657ACYEZ
https://cyclonedx.github.io/cdxgen/
Apache License 2.0
567 stars 157 forks source link

Issue in Clojure dependency fetch #482

Open agrawalarpit01 opened 1 year ago

agrawalarpit01 commented 1 year ago

I am trying to generate sbom for one of my clojure applications. But getting this in the output and generated file has no dependencies listed. What could be the possible reason of this?

"Executing lein deps :tree-data in /builds/wcnp/data-api-test Check if the correct version of lein is installed and available in PATH. Falling back to manual parsing."

prabhu commented 1 year ago

@agrawalarpit01 We invoke the lein command. Is it installed? You can try the container image, which packages all the tools. Alternatively, please share the output of 

which lein
lein deps :tree-data
agrawalarpit01 commented 1 year ago

Okay, let me check and confirm the same.

Also, could you please let me know if we can generate the "dependency graph" using cdxgen in dependency track?

prabhu commented 1 year ago

You can find the full list on readme. clojure is not supported yet.

https://github.com/CycloneDX/cdxgen#dependency-tree

agrawalarpit01 commented 1 year ago

lein version used is: Leiningen 2.7.1 on Java 1.8.0_345 OpenJDK 64-Bit Server VM

but still not able to get the bom output and getting below error

Executing lein deps :tree-data in /builds/wcnp/data-api-test lein unexpectedly didn't return any output

prabhu commented 1 year ago

@agrawalarpit01 Is there any output when lein is executed directly?

lein deps :tree-data
agrawalarpit01 commented 1 year ago

yes, I am getting full list of packaged being retrieved.

prabhu commented 1 year ago

@agrawalarpit01 Could you share this output via email or privately via discord?

https://discord.gg/pF4BYWEJcS

Or is there another public project to reproduce this issue? I tested with an example app https://github.com/Azure-Samples/clojure-on-app-service, and it works correctly.

agrawalarpit01 commented 1 year ago

I will share the output over discord

do you see any issue in this command cdxgen -t clojure -r -o bom.json --server-url https://dependencytrackerapi/ --project-name clj-test --api-key xxxxxxxxxxxxxxx --project-version 1.1 --spec-version 1.4