cyclonedx-dotnet-library icon indicating copy to clipboard operation
cyclonedx-dotnet-library copied to clipboard

hierarchical merging with an SBOM that contains no root level components causes exception

Open tucker01 opened this issue 2 years ago • 0 comments

While attempting to merge multiple BOMs with cyclonedx merge --hierarchical I received:

Unhandled exception: System.ArgumentNullException: Value cannot be null. (Parameter 'collection')
   at System.Collections.Generic.List`1.InsertRange(Int32 , IEnumerable`1 )
   at CycloneDX.Utils.CycloneDXUtils.HierarchicalMerge(IEnumerable`1 boms, Component bomSubject)
   at CycloneDX.Cli.Commands.MergeCommand.Merge(MergeCommandOptions options)
   at System.CommandLine.Invocation.CommandHandler.GetExitCodeAsync(Object value, InvocationContext context)
   at System.CommandLine.Invocation.ModelBindingCommandHandler.InvokeAsync(InvocationContext context)
   at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<<BuildInvocationChain>b__0>d.MoveNext()

I believe this is caused by the absence of the root level components property in one of the BOMs.

However, the cyclonedx validate command reports:

BOM validated successfully. 

Also, the spec doesn't indicate that the root level components property is required.

tucker01 avatar Jul 12 '22 19:07 tucker01