You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I was working on a project to test diffrent SBOM converters and also looked into Syft. I think you do a really good job, better then most other tools that provide converters for SBOMs.
One thing that looked like a simple bug to me was, that syft looses the algorithm of a checksum when converting. This only happens while converting from SPDX to CycloneDx. From CycloneDx to SPDX the value is mapped correctly.
I put some notes together in a blogpost about my tests with all tools. There are more minor things that were not mapped correctly but this issue feels like a bug while the others more look like it's hard to map all SPDX and CycloneDx fields. And you guys already stated that converting with Syft is experimental and will lose data. So i guess you already know about that.
What happened:
I was working on a project to test diffrent SBOM converters and also looked into Syft. I think you do a really good job, better then most other tools that provide converters for SBOMs.
One thing that looked like a simple bug to me was, that syft looses the algorithm of a checksum when converting. This only happens while converting from SPDX to CycloneDx. From CycloneDx to SPDX the value is mapped correctly.
Input:
Output:
Round Trip
What you expected to happen:
It feels like a bug that the algorithm type is lost. Looks like CycloneDx and SPDX both support this field.
Steps to reproduce the issue:
This are the command and SBOMs i used:
Command:
sboms.zip
Anything else we need to know?:
I put some notes together in a blogpost about my tests with all tools. There are more minor things that were not mapped correctly but this issue feels like a bug while the others more look like it's hard to map all SPDX and CycloneDx fields. And you guys already stated that converting with Syft is experimental and will lose data. So i guess you already know about that.
https://mariuxdeangelo.gitlab.io/website/#/post/20230925-SBOM-Convertion-Tools
Environment:
syft version
:cat /etc/os-release
or similar):The text was updated successfully, but these errors were encountered: