-
-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enhancement: more information about schema errors #35
Comments
Second example. I ran this on an SBOM with 9928 components. There were duplicate components.
The message is correct, |
Hi @esnible, Let me try and respond to your comments...
The non-strict CDX v1.2 JSON schema does enforce the "OneOf" constraint for "license" (not just in strict): In fact, the "strict" schema, if a "diff" is performed, typically only adds the
Unfortunately, the schema error results processing code only reports at the granularity of the owning object, in this case an If you would like to add special logic as a pull request to look for this specific error case (i.e., array uniqueness) and post-process the error results to reduce the result set reported (as you likely did manually after using Otherwise, please update the title to limit the request to that specific enhancement (and ack. that the "v1.2" / strict issue) is not the enhancement being requested... If you do submit a PR, please reference this issue. |
@esnible I was wondering why your tooling was still using an outdated version of the .NET tool:
which was from June 27, 2021 (https://github.com/CycloneDX/cyclonedx-dotnet/releases/tag/v1.6.1). as I see that the latest version is 2.7: I would imagine that the newer version would support v1.3 at the very least, but expect it to support v1.4 which has been out for some time and v1.5 will be released GA in a few weeks. |
BTW, I almost missed your last question...
The answer is simple looking at the schema for "license":
you need to provide one of the required fields... either |
@esnible I may ask you to close this issue and then create a new one solely for the "enhancement" to the "array error result processing" so that when a developer works on it, it is disentangled from the other questions/issues surfaced here. Would that be possible? You can ref. this issue for history... |
I created this issue after I received a proprietary SBOM with 37562 components, but only 5812 unique components. I couldn't attach the proprietary SBOM, but saw a similar error in the public github.com/chainguard-dev/bom-shelter repo. I am not using the old tooling myself. It might be better if you created the "array result processing enhancement" Issue. I know what I want to see but I don't know how to express it within the schema validation terminology. When I see a message saying I have "64440 errors" in my SBOM, my wish is that "having duplicates" would be displayed as one error, not as a unique error for every duplicate pair. The large number of duplicate pair errors make it hard to see if any other errors besides duplication are present. |
@esnible I understand your intent and will try to open a new issue and ref. this one... however, this will require IMO a new "special processing" path (with new flags to enable/disable) and require some considered thought to only collapse/condense when it can be certain they are the same error. However, having this many errors (esp. duplicates is NOT normal). In any event, the tool developer should not be producing duplicates (invalid SBOMs) and hopefully you are opening an issue against them as they are clearly not validating their output at all! |
Saved the enhancement request in a separate issue #37 |
I tried sbom-utility against https://github.com/chainguard-dev/bom-shelter/blob/main/in-the-wild/cyclonedx/obsidian-sailboat-sbom-cdx.json . 407 errors were found, here is the first one:
First question. sbom-utility logged
Schema "schema/cyclonedx/1.2/bom-1.2.schema.json" loaded.
but the error seems to be coming from validation in resources/schema/cyclonedx/1.2/bom-1.2-strict.schema.json, not resources/schema/cyclonedx/1.2/bom-1.2.schema.json.The failing validation is
The failing component has
It isn't clear to me what is wrong with this license. In this case I could tell from the URL which fragment was the problem but I would like to see the JSON Path, e.g. to component. I would also like to see the more details of the failed validation. At first glance I see a license.
Type: [number_one_of], Field: [components.0.licenses.0.license], Description: [Must validate one and only one schema (oneOf)] No "license", no "expression"
Failing object components[0]/license[0] : [{
"url": "https://github.com/AngleSharp/AngleSharp/blob/master/LICENSE"
}]
The text was updated successfully, but these errors were encountered: