Skip to content

Certain Valid SBOMs fail on Conversion. #316

@txdvse

Description

@txdvse

Describe the bug
Some valid SBOMs that are uploaded to SBOM-in-a-Box fail when attempting to convert them. This shouldn't happen since the original SBOM matches the required elements to be uploaded to SBOM-in-a-Box.

To Reproduce
Steps to reproduce the behavior:

  1. Use the SPDX SBOM attached to this card
  2. Open SBOM-in-a-Box
  3. Upload the SPDX SBOM
  4. Select it and press the Convert button
  5. In the pop-up, select CDX14 for 'format' and use any desired schema.
  6. Select Convert in the pop-up window.

Expected behavior
The SBOM will not be converted. Reload the SBOM-in-a-Box client to confirm.
The following message was displayed in the terminal when attempting to convert the SPDX SBOM to a CDX14 SBOM.
svip-api | 2024-01-03 19:33:51.379 | ERROR | Serialized SBOM does not match schema=CDX14 (null)

Screenshots
If applicable, add screenshots to help explain your problem.
Screen Shot 2024-01-03 at 2 35 33 PM
Screen Shot 2024-01-03 at 2 36 10 PM

Additional context
The file in question:
dubboMavenSBOMSPDX.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions