Open Nicolas-Peiffer opened 1 month ago
Thanks for the report, @Nicolas-Peiffer -- just a note: use of this field is deprecated in 1.6, but still part of the spec and allowed so I don't think it's necessary to change it today.
That said, we definitely will need to update things in the future but I ran into an issue with the cyclonedx library we are using that the authors
field results in invalid CycloneDX 1.5 output. I've filed an issue about this and will follow it up with a PR if it becomes an issue when we have to make the change.
What happened
The deprecated syntax for the "
author
" field is still used bysyft v1.9.0
, resulting in the following warning/error deprecation message:Expected "
authors
" fieldYou can see an example of a valid
authors
field of CycloneDX v1.6 here: https://github.com/CycloneDX/specification/blob/62a669075f1897193a14060e0784e6a7576b693d/tools/src/test/resources/1.6/valid-bom-1.6.json#L26You can check cyclonedx 1.6: https://cyclonedx.org/docs/1.6/json/#components_items_author
The BOM file generated by Syft should look like this:
In
github.com/CycloneDX/cyclonedx-go
, there is a deprecation notice for theauthor
field// Deprecated: Use authors or manufacturer instead.
.The
authors
field is implemented like this: https://github.com/CycloneDX/cyclonedx-go/blob/795ee183544e3f8376b984e911f00188f79e90d8/cyclonedx.go#L230Steps to reproduce the issue
In our case,
syft
is triggered by a tool calledgoreleaser
on a GoLang project on a Gitlab.This
syft
fromgoreleaser
command corresponds to:Environment
Output of
syft version
:OS (e.g:
cat /etc/os-release
or similar):cc @louison77