Closed schlenk closed 1 year ago
Still broken with cyclonedx-cli 0.24.2 binary.
@schlenk According to the specification
https://cyclonedx.org/docs/1.4/xml/#type_component
publisher
needs to be in front of the name
. If I swap these two, I'm able to validate the BOM successfully.
Ok, you are right, seems the tool creating the file messed up.
I tried to validate a SBOM with a component containing a publisher entry. This should be valid, according to: https://cyclonedx.org/docs/1.4/xml/#type_component
But running it through cyclonedx-cli validate complains about the tag. Removing the tag allows successful validation.
Edit: This was with the latest released binary version. I assume updating to a newer version with up to date .NET cyclonedx library would fix it, as the schema contains publisher there since 5.2.0. But the 0.24 binary was built with 5.1.1.