bgnetworks / meta-dependencytrack

A Yocto meta-layer for generating CycloneDX SBOMs and automatically uploading them to Dependency Track.
https://bgnet.works
Other
19 stars 22 forks source link

Fix invalid bom format #10

Open Jasper-Ben opened 6 months ago

Jasper-Ben commented 6 months ago

According to https://cyclonedx.org/docs/1.4/json/#components_items_type each component must have a type defined for a bom to be valid cyclonedx. This definition was previously missing from the generated bom.

Since 4.11 of DT (https://github.com/DependencyTrack/dependency-track/pull/3522) uploaded boms are validated against the cyclonedx schema, thus causing meta-dependencytrack to fail.