search

LLNL / Surfactant

Modular framework for file information extraction and dependency analysis to generate accurate SBOMs
MIT License
20 stars 14 forks source link

Merge throws an error with CycloneDX #243

Open gliese1337 opened 1 month ago

gliese1337 commented 1 month ago

Describe the bug When trying to merge input SBOMs in CycloneDX format, the surfactant CLI produces and error message and no output.

To Reproduce Steps to reproduce the behavior:

  1. run surfactant merge --input_format cyclonedx --output_format cyclonedx sbom1.json sbom2.json
  2. Observe error: 
    2024-08-19 14:30:21.305 | WARNING  | surfactant.infoextractors.docker_image:is_docker_scout_installed:21 - Install Docker Scout to scan containers for additional information
2024-08-19 14:30:21.458 | ERROR    | surfactant.plugin.manager:find_io_plugin:100 - No "read_sbom" plugin for format "cyclonedx" found

Expected behavior The input SBOMs should be merged and an output SBOM produced.

System Information (please complete the following information):

Additional context One of the inputs was generated with surfactant, the other with npm-sbom.

nightlark commented 1 month ago

Reading input SBOMs in CycloneDX (and SPDX eventually) formats is being implemented in PR https://github.com/LLNL/Surfactant/pull/221 if you want to try it out and provide feedback. From discussion with @mws180000 and others, there are some lossy aspects to conversion between formats (including to the internal representation that is used as an intermediate format by the merge feature).