Repository navigation
Merge does not deduplicate components with differing bom-ref #399
Description
Given the following two test files, their merged output does not deduplicate components as mentioned in CycloneDX/cyclonedx-python-lib#540 (comment)
File test/in1.json:
{
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"metadata": {"component": {"bom-ref": "test11", "type": "container", "name": "alpine"}},
"components": [{"bom-ref": "test12", "type": "operating-system", "name": "alpine"}],
"dependencies": [{"ref": "test11", "dependsOn": ["test12"]}]
}and test/in2.json:
{
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"metadata": {"component": {"bom-ref": "test21", "type": "container", "name": "alpine"}},
"components": [{"bom-ref": "test22", "type": "operating-system", "name": "alpine"}],
"dependencies": [{"ref": "test21", "dependsOn": ["test22"]}]
}The following merge command:
docker run --rm -v $(pwd)/test:/test cyclonedx/cyclonedx-cli:0.26.0 merge --input-files /test/in1.json /test/in2.json --input-format json --output-format json --output-file /test/out.json --name testProduces the following output file test/out.json, which contains duplicate components:
{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"serialNumber": "urn:uuid:66fa5692-2e9d-45c5-830a-ec8ccaf7dcc9",
"version": 1,
"metadata": {
"component": {
"type": "application",
"name": "test"
}
},
"components": [
{
"type": "operating-system",
"bom-ref": "test12",
"name": "alpine"
},
{
"type": "container",
"bom-ref": "test11",
"name": "alpine"
},
{
"type": "operating-system",
"bom-ref": "test22",
"name": "alpine"
},
{
"type": "container",
"bom-ref": "test21",
"name": "alpine"
}
],
"dependencies": [
{
"ref": "test11",
"dependsOn": [
"test12"
]
},
{
"ref": "test21",
"dependsOn": [
"test22"
]
}
]
}Reacted by Jannik Hollenbach, Rémi Aubel, bwt-sloanj and Arthur Khashaev
Activity
wkoot commentedon Oct 23, 2024
Since the file validation changes introduced to Dependency-Track in version 4.11, files produced by
cyclonedx-cli mergein this manner also produce errors in DT: