cyclonedx-cli
cyclonedx-cli copied to clipboard
Incorrect Purl element instead of purl in evidence section
When using version 0.25.0 in Azure DevOps (with CycloneDX version 1.5) and trying to merge an SBOM from cdxgen (using version 10.1.0) from https://github.com/CycloneDX/cdxgen that contains "evidence", the JSON SBOM file contains the following:
{
"type": "library",
"bom-ref": "pkg:npm/matchmedia()-polyfill@Test a CSS media type/query in JS. Authors \u0026 copyright (c) 2012: Scott Jehl, Paul Irish, Nicholas Zakas. Dual MIT/BSD license */",
"group": "",
"name": "matchmedia()-polyfill",
"version": "Test a CSS media type/query in JS. Authors \u0026 copyright (c) 2012: Scott Jehl, Paul Irish, Nicholas Zakas. Dual MIT/BSD license */",
"purl": "pkg:npm/matchmedia()-polyfill@Test%20a%20CSS%20media%20type%2Fquery%20in%20JS.%20Authors%20%26%20copyright%20(c)%202012:%20Scott%20Jehl%2C%20Paul%20Irish%2C%20Nicholas%20Zakas.%20Dual%20MIT%2FBSD%20license%20*%2F",
"properties": [
{
"name": "SrcFile",
"value": "xxxx/Scripts/respond.min.js"
}
],
"evidence": {
"identity": {
"field": "Purl",
"confidence": 0.25,
"methods": [
{
"technique": "filename",
"confidence": 0.25,
"value": "xxxx/Scripts/respond.min.js"
}
]
}
}
},
While it should be:
{
"type": "library",
"bom-ref": "pkg:npm/matchmedia()-polyfill@Test a CSS media type/query in JS. Authors \u0026 copyright (c) 2012: Scott Jehl, Paul Irish, Nicholas Zakas. Dual MIT/BSD license */",
"group": "",
"name": "matchmedia()-polyfill",
"version": "Test a CSS media type/query in JS. Authors \u0026 copyright (c) 2012: Scott Jehl, Paul Irish, Nicholas Zakas. Dual MIT/BSD license */",
"purl": "pkg:npm/matchmedia()-polyfill@Test%20a%20CSS%20media%20type%2Fquery%20in%20JS.%20Authors%20%26%20copyright%20(c)%202012:%20Scott%20Jehl%2C%20Paul%20Irish%2C%20Nicholas%20Zakas.%20Dual%20MIT%2FBSD%20license%20*%2F",
"properties": [
{
"name": "SrcFile",
"value": "xxxx/Scripts/respond.min.js"
}
],
"evidence": {
"identity": {
"field": "purl",
"confidence": 0.25,
"methods": [
{
"technique": "filename",
"confidence": 0.25,
"value": "xxxx/Scripts/respond.min.js"
}
]
}
}
},
When trying then to upload the SBOM to Dependency Track it fails with the following Error:
Caused by: com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type org.cyclonedx.model.component.evidence.Identity$Field from String "Purl": not one of the values accepted for Enum class: [cpe, name, hash, swid, version, purl, group]
Can someone confirm this issue and could this then be fixed? I can also help if needed!