CycloneDX
Expose merging SBOMs
Hello 👋 we are starting the work on integrating cyclonedx in buildpacks. As a part of this work, we need to be able to merge cyclonedx SBOMs provided by various buildpacks involved in the build process through our go based binary called the lifecycle. We were hoping for the behavior exposed by the cyclonedx CLI to be available via a go library. Would it be possible to add this as an enhancement?
Note to self: Merging as performed by the CLI is implemented here in the .NET library: https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/main/src/CycloneDX.Utils/Merge.cs
Don't be limited by what I managed to implement for merging in the CLI tool. It still requires some work. Especially around the flat merging approach. i.e. it doesn't handle dependency graphs. But from memory the hierarchical merging was reasonably feature complete.
Yeah, there are a few other points I'd like to address with flat merging. Like deduplication of components and services, rewiring of the dependency graph etc. I've used a merging library for the initial implementation, but that may not be the best idea after all. Will need to do a bit more research here.
This would be really great to see. I'm working with CycloneDX in Go and my options for merging at the moment are:
- Implement this myself
- Exec out to the cyclonedx CLI.
Neither are very appealing!
