search

opensbom-generator / spdx-sbom-generator

Support CI generation of SBOMs via golang tooling.
408 stars 110 forks source link

SSB-31: Go - Packages in Relationship DEPENDS_ON are not sorted alphabetically #106

Open rynofinn opened 3 years ago

rynofinn commented 3 years ago

Original Reporter: nvelagapudi Environment: Not Specified Version: Not Specified Migrated From: http://jira.linuxfoundation.org/browse/SSB-31

spdx-sbom-generator tool version v0.0.2Test Repo that I used for testinghttps://github.com/spdx/spdx-sbom-generatorObserved that Packages in Relationship DEPENDS_ON are not sorted alphabetically. If there are sorted alphabetically sorted it would be easier for the user to check the dependenciesPFA SPDX file reference

opedroso commented 2 years ago

Having them sorted alphabetically would also allow comparison of differences in dependencies between different platform output for the same project.

opedroso commented 2 years ago

Here is an AWK script that can be used to workaround this problem. Run it like this: awk -f sort_depends_on_relationships.awk.txt ./bom-go-mod.spdx > bom-go-mod_sorted.spdx sort_depends_on_relationships.awk.txt