License and vulnerability analysis not done Dependency Track
See original GitHub issueHi,
When I try to upload bom json or xml output to Dependency Track as given below. Eventhough the components are listed but the license and vulnerability analysis is not performed by Dependency Track.
cdxgen -r -o bom.json --server-url $DT_URL --api-key $DT_KEY
But the same json output license and vulnerability analysis are performed correctly If I upload it to the DT UI or via DT REST API.
The DT logs doesn’t show any errors and the logs are same when I run the above command and If I upload it via UI and REST API. I don’t have a clue why this is happening.
Dependency-Track v4.5.0
Thanks
Issue Analytics
- State:
- Created a year ago
- Comments:20
Top Results From Across the Web
Frequently Asked Questions - Dependency-Track
Frequently asked questions about Dependency Track functionality that may not be covered by the documentation. If you don't find an answer here, try...
Read more >No vulnerabilities matched for sboms with vulnerable ... - GitHub
I have tried getting Dependency-Track to find the vulnerabilities we are already scanning with Dependency-Check.
Read more >OWASP Dependency-Track
This approach provides capabilities that traditional Software Composition Analysis (SCA) solutions cannot achieve.
Read more >Managing Vulnerabilities using Dependency-Track - InfraCloud
Can we manage to track vulnerabilities within the dependencies of our ... WhiteSource - it's an open-source component analysis, license and ...
Read more >owasp/dependency-track - Docker Image
Dependency -Track is an intelligent Component Analysis platform. ... with known vulnerabilities; Out-of-date components; Modified components; License risk ...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
@prabhu you are right using
-t python
worked. So it’s a bug. Also while running this command I got node error:as far as I see the cdxgen console output has license information;
{ “group”: “”, “name”: “react-i18next”, “version”: “11.18.5”, “description”: “Internationalization for react done right. Using the i18next i18n ecosystem.”, “scope”: “required”, “hashes”: [ { “alg”: “SHA-512”, “content”: “70a732baecc8bf461467897d58e45f95536e84848f02a41284e02cc7017262e268080ec794b9879bb5e7bceea17c01a61a90cd461247a015fc846e3d09bdb165” } ], “licenses”: [ { “license”: { “id”: “MIT”, “url”: “https://opensource.org/licenses/MIT” } } ], “purl”: “pkg:npm/react-i18next@11.18.5”, “externalReferences”: [ { “type”: “website”, “url”: “https://github.com/i18next/react-i18next” }, { “type”: “vcs”, “url”: “git+https://github.com/i18next/react-i18next.git” } ], “type”: “library”, “bom-ref”: “pkg:npm/react-i18next@11.18.5” },
but nothing reaches dependency-track. the file doesnt contain any license information when i add -o bom.xml.
I tried capturing the whole console output and uploading to dependency-track, it got processed without issues