I was using the JSON output of this tool as an input for another tool. I implemented a validation function in python for my other tool in order to ensure its correctness before processing the file, and can be seen as follows:
import json
import jsonschema
import pkg_resources
def validate_bom(filename):
bom = json.load(open(filename, "r"))
spec_version = bom.get("specVersion", None)
schema_path = pkg_resources.resource_filename('cyclonedx', f'schema/bom-{spec_version}.schema.json')
bom_schema = json.load(open(schema_path, "r"))
try:
jsonschema.validate(instance=bom, schema=bom_schema)
except jsonschema.exceptions.ValidationError as err:
raise err
return True
In this case I was using I created a BoM using schema v1.3 and noticed that there was a version value missing from the component within the optional metadata property, and was throwing an error as invalid.
In the schema file bom-1.3.schema.json, the optional metadata section, allows for components to be listed and references the component in the #/definitions/component section, where a version is required. In this case, there was no version associated with the component found in the metadata secion.
The output is therefore non-compliant to the v1.3 schema standard, and the output should be verified to ensure that it is compliant before outputting to the user.
I was using the JSON output of this tool as an input for another tool. I implemented a validation function in python for my other tool in order to ensure its correctness before processing the file, and can be seen as follows:
In this case I was using I created a BoM using schema v1.3 and noticed that there was a
versionvalue missing from the component within the optionalmetadataproperty, and was throwing an error as invalid.In the schema file bom-1.3.schema.json, the optional metadata section, allows for components to be listed and references the component in the
#/definitions/componentsection, where a version is required. In this case, there was no version associated with the component found in the metadata secion.The output is therefore non-compliant to the v1.3 schema standard, and the output should be verified to ensure that it is compliant before outputting to the user.