No results when scanning CycloneDX file from cargo-cyclonedx
Feelemoon opened this issue · 3 comments
When scanning a CycloneDX file from https://github.com/CycloneDX/cyclonedx-rust-cargo no output is generated.
It would be nice, if the user is informed if the BOM has been scanned or not (for some reason).
Thanks for the issue! We'll take a look.
@Feelemoon I used [this](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/cyclonedx-bom/tests/data/1.3/valid-bom-1.3.json] SBOM from that project and although it is valid JSON, it had an empty Purl in it which caused a problem. Bomber threw a "scheme missing" error - which doesn't say much. In the JSON the issue is with the second component. It has no Purl and therefore can't be scanned:
I was testing with the new 0.4.1 version of bomber which we just released, and we did put fix some output issues when nothing was found. Here is a debug screenshot:
Not sure if you were testing another SBOM, but could you try running 0.4.1 on it?