Stacktrace thrown when scanning cyclonedx SBOM created against Python project
See original GitHub issueWhen running depscan against a bom.xml file generated by CycloneDX for a Python project, the following stack trace is thrown:
Traceback (most recent call last):
File "/home/matthew/.local/bin/depscan", line 8, in <module>
sys.exit(main())
File "/home/matthew/.local/lib/python3.10/site-packages/depscan/cli.py", line 260, in main
os.makedirs(reports_dir)
File "/usr/lib/python3.10/os.py", line 225, in makedirs
mkdir(name, mode)
FileNotFoundError: [Errno 2] No such file or directory: ''
How to reproduce:
- Clone the Google Microservice demo:
git clone https://github.com/GoogleCloudPlatform/microservices-demo.git
- Open the email service (A Python project):
cd microservices-demo/src/emailservice
- Create the SBOM file:
cyclonedx-py -r --output bom.xml
- Scan the bom.xml file:
depscan --bom "bom.xml" --type bom --report_file depscan.json
This is the sample bom.xml file: bom.zip
Issue Analytics
- State:
- Created a year ago
- Comments:10 (6 by maintainers)
Top Results From Across the Web
CycloneDX Tool Center
Dependency Scanning analyzer that uses the GitLab Advisory Database and generates CycloneDX SBOMs. opensource github-action. Generate SBoM for Elixir project.
Read more >CycloneDX Python SBOM Generation Tool - GitHub
Creates CycloneDX Software Bill of Materials (SBOM) from Python projects and ... This project provides a runnable Python-based application for generating ...
Read more >Mend Server Release Notes
In a specific case, when the Unified Agent scanned a Gradle project, a stack trace exception was thrown without the error information. Addressed...
Read more >1 - Update gemnasium to output CycloneDX SBOMs ... - GitLab
Release notes In order to align with a popular Software Bill of Materials (SBOM) industry format standard, Dependency Scanning's gemnasium ...
Read more >Software Bill of Materials for next Python release
Python should also work on these lines to integrate SBOM in it's build pipeline. CycloneDx by OWASP provides excellent tools to construct SBOMs ......
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@prabhu
depscan --src $PWD
does work ok.Please also test with cdxgen https://github.com/AppThreat/cdxgen and let me know how it looks for your apps.