Support CycloneDX #3
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- create pydantic models for CycloneDX v1.6 and SPDX v2.3 - use uv for running without venv - remove outdated test file UV is not required, but recommended. Versions in the requirements.txt are known to work.
There was a problem hiding this comment.
Pull Request Overview
Adds CycloneDX (v1.6) support alongside existing SPDX (v2.3) by introducing Pydantic models and refactoring SBOM parsing and merging logic. Also updates usage instructions to optionally run via uv and removes an outdated test file.
- Introduces typed models for SPDX and CycloneDX and unified FDARecord export format
- Refactors merge/dedup logic (list-based FDARecord processing) and Excel export
- Removes prior merge test; README updated with supported formats and uv usage
Reviewed Changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| gen_sbom.py | Major refactor: adds data models, new merge/deduplicate logic, Excel export rewrite, CycloneDX support |
| README.md | Documents supported formats and uv-based execution |
| test_gen_sbom.py | Removed legacy merge test (no replacement added) |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
xaker00
force-pushed
the
feat/process-cyclonedx
branch
from
dfb4631 to
7c91e20
Compare
VCPKG is in the process of better supporting SBOMs. In the meantime, this is the next best solution. This allows mapping the packages to CPE strings. There is a manual map in vcpkg.yml. Not very nice, but better than nothing.
Mostly AI generated. Trivy and Syft/Grype are better tools. Use this only as a last resort. There is a reason there are entire projects and paid products exist solve this problem. It is not trivial. You can get around 80% with this tool, but the last 20% is very difficult.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
UV is not required, but recommended. Versions in the requirements.txt are known to work.