search

Festo-se / cyclonedx-editor-validator

Tool for creating, modifying and validating CycloneDX SBOMs.
https://festo-se.github.io/cyclonedx-editor-validator/
GNU General Public License v3.0
18 stars 4 forks source link

`build-public` messes up compositions #154

Closed mmarseu closed 2 months ago

mmarseu commented 5 months ago

The build-public command does something surprising to the .compositions array. I haven't checked in the code what exactly it does but it definitely deletes some entries that shouldn't be deleted.

For example, use build-public with a dummy schema that doesn't match anything (see #153) on https://github.com/Festo-se/cyclonedx-editor-validator/blob/8bdf8fd2195b68c18a9f76d74146a8f8d14550a3/tests/auxiliary/test_set_sboms/test.cdx.json#L175-L189

The command shouldn't delete anything and therefore the SBOM should simply remain untouched. However, the result is

"compositions": [
        {
            "aggregate": "incomplete",
            "assemblies": [
                "com.company.unit/depA@4.0.2",
                "some-vendor/depB@1.2.3",
                "depC@3.2.1"
            ]
        }
],