CycloneDX
Dependency Graph cannot be generated
Hi I think I ran into the same issue as described here: https://github.com/CycloneDX/cdxgen/issues/243
When generating a bom.json with "cdxgen -o bom.json" and uploading the file into Dependency Track (https://docs.dependencytrack.org/) it does not create a dependency graph.
I used this project as a sample: https://github.com/acemilyalcin/sample-node-project
If I try "cyclonedx-npm --output-file bom.json" it works.
Here are both bom files:
Thank you in advance!
The issue was fixed in 8.1.2 but while working with projects containing multiple sub projects for example if a project has a backend and the frontend then cdxgen just uses one of them as bom-ref which leads to the tree containing only half of the components, So it will either have only frontend components or only backend components.
@prabhu any fix regarding that possible?
@prabhu For example in a project like this which contains maven and npm packages, https://github.com/darecoder/Polling-App only the npm packages are part of the dependency tree on dependency tracker.
The issue i can see is that as the npm packages and maven packages are not dependent on each other therefore 2 separate trees are being generated and cdxgen picks the root of one of those trees.
The solution as far as i can see would be to either add a false root and combine all the roots together or render multiple trees in dependency tracker
@phoenix-aditya could you file an enhancement request for dependency-track to render multiple subtrees?
@prabhu is this feature addition possible? https://github.com/DependencyTrack/dependency-track/issues/2572#issuecomment-1458013850
I guess the feature is not required in cyclonedx Plugins as the problem wont exist as they are tech stack dependent , Whereas is a part of cdxgen as cdxgen supports generation of sboms with multiple tech stack projects therefore can have multiple dependency trees for each.
@phoenix-aditya
I guess the feature is not required in cyclonedx Plugins as the problem wont exist as they are tech stack dependent
Even under same tech stack (Java/gradle), I'm facing the same issue if you have subprojects under subdirs with different gradle files. The superproject and the subproject are only related in terms of superdirectory and subdirectories and do not have any parent-dependency relation and thus not rendered in DT.
I'm also having issues seeing a Dependency Graph in Dependency Track when using cdxgen version 9.3.1. I've tested across npm, maven and nuget repositories with the same outcome (no dependency graph)
@setchy could you kindly share any test projects and generated sbom to reproduce the issue? If the projects are private, you can share them via discord.
https://discord.gg/pF4BYWEJcS
@setchy could you kindly share any test projects and generated sbom to reproduce the issue? If the projects are private, you can share them via discord.
https://discord.gg/pF4BYWEJcS
Raised https://github.com/CycloneDX/cdxgen/issues/447 after doing some further debugging locally