Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

No hashes in boms

See original GitHub issue

Upgraded from 4.0.21 to 4.0.41 and the boms being produced do not have hashes included for the components. Sorry if I’ve missed something obvious. command used: cdxgen -t java -o bom.xml A sample of each output is below.

4.0.21 <component type="library" bom-ref="pkg:maven/p2.eclipse-plugin/org.apache.commons.jxpath@1.3.0.v200911051830?type=jar"> <group>p2.eclipse-plugin</group> <name>org.apache.commons.jxpath</name> <version>1.3.0.v200911051830</version> <scope>optional</scope> <hashes> <hash alg="MD5">dd4d333f38384e6570c3cdced36f1ba7</hash> <hash alg="SHA-1">7aba488947c98427d91318f885ccd99e3fcb0785</hash> <hash alg="SHA-256">0278be02a3027aadb3e37a15dd48c536bb27d7327ec9cee7700be19032c0eb98</hash> <hash alg="SHA-384">fdc1a7ea6af6cc177d136d2bcccff27ba2c044ea5d63ba2290b757b0351374303daab838b363bb7483284bd23a206371</hash> <hash alg="SHA-512">ff24dc78613083fefa3a6e3528ced4dc0b9fb4ac30a99fed4b90aa8ce85a3d90b064ddaa856de3630a7629944a9125b070aaaee2dc4deb35921d523007f71003</hash> </hashes> <purl>pkg:maven/p2.eclipse-plugin/org.apache.commons.jxpath@1.3.0.v200911051830?type=jar</purl> </component>

4.0.41: <component type="library" bom-ref="pkg:maven/p2.eclipse-plugin/org.apache.commons.jxpath@1.3.0.v200911051830"> <group>p2.eclipse-plugin</group> <name>org.apache.commons.jxpath</name> <version>1.3.0.v200911051830</version> <description/> <scope>optional</scope> <licenses/> <purl>pkg:maven/p2.eclipse-plugin/org.apache.commons.jxpath@1.3.0.v200911051830</purl> </component>