-
Notifications
You must be signed in to change notification settings - Fork 521
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Relationships / Dependencies are present in Syft json and SPDX json files but sometimes not in Cyclonedx json file format #2832
Comments
Dev notes: there are some format limitations in CycloneDX that prevent us from representing every relationship that we handle in other formats like SPDX, so there will always be some functionality differences between the various formats. We could probably encode CONTAINS and DEPENDS-ON relationships in CycloneDX, though. The challenge encoding the CONTAINS relationship is that it requires nesting components in CycloneDX which we aren't currently doing--it wouldn't be expressible in the dependency relationships. @haiazuki, if you are able, can you share a bit more about your use case and needs here? Are you looking for a source code dependency tree or something similar? More details might be helpful for us to look into this. Thanks! |
Hi @tgerla , Thank you! |
I see syft producing usable Cyclonedx dependency information for image scans except from the tiny detail described here: DependencyTrack/dependency-track#3314 I have tried manually adding the missing dependency between the root object and some random set of modules and then DT can show a dependency tree for that part. It seems DT doesn't even try to build a dependency tree when the root dependency is missing. Probably because it doesn't know where to start. Is there a good reason this has not been fixed already (or why the issue has ever arisen)? |
Shouldn't this need to be included in milestone "Meet NTIA Minimum SBOM Requirements" as relationships are part of the minimum elements in NTIA? |
👋 I think it would be useful for this issue if we could posting specific examples of where dependencies should exist in cyclone-dx and they are not showing up. Syft currently uses the Are there other sections we should be putting non dependency relationship information? A good example of the format I'm looking for to help the discussion is something like this:
In
These All I see in cyclone-dx are the depends on relationships - here is an example:
|
Hi @spiffcs, |
What happened:
I am not seeing dependencies information on CycloneDX format json files even though they are present in other formats:
SPDX file snippet:
What you expected to happen:
Dependencies should appear in the Cyclonedx format json file similar to SPDX and Syft json files.
Steps to reproduce the issue:
I tried generating SBOM file in CycloneDX format and noticed that no dependencies are included in the sbom file. But then I tried generating an SBOM in Syft json and SPDX json formats and see that relationships / dependencies information are present. I tried converting the SBOM to CycloneDX format and no dependencies information are included in the output.
Anything else we need to know?:
N/A
Environment:
Output of
syft version
:Application: syft
Version: 1.2.0
BuildDate: 2024-04-12T18:31:58Z
GitCommit: dde5d34
GitDescription: v1.2.0
Platform: windows/amd64
GoVersion: go1.21.9
Compiler: gc
OS (e.g:
cat /etc/os-release
or similar):Windows 11 Enterprise
The text was updated successfully, but these errors were encountered: