Difference between using docker image and cdxgen cli

[priyasharma127]

docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen:v8.6.0 -r /app -o /app/bom.json

FAILURE: Build failed with an exception
Project EX/Projecta not found in the root project 'app'.

where as when used cdxgen -o bom.json, it uses colon notation ex:Projecta and no issues

how can rectify this?

[prabhu]

@priyasharma127, can you try with the latest version? You can pass --spec-version 1.4 if you want the sbom in 1.4 format.

[prabhu]

@priyasharma127, possibly a bug in gradle parsing. Can you attempt to reproduce this with any public repo and file a bug? We don't have anyone working full-time on cdxgen, so we would appreciate a pull request or a detailed bug report to make it easy to fix.

[priyasharma127]

Hi @prabhu,
To run cdxgen docker image for a repository, does the application needs to be build first? What would be the difference to run cdxgen after application build or just running on the repo without build?

[prabhu]

@priyasharma127, there is no requirement for the build, but the environment must be buildable (with the correct version of Java, maven, etc, installed based on the application).

[priyasharma127]

Hi @prabhu, I get warnings : Invalid refs when running in debug mode only.
docker run -e CDXGEN_DEBUG_MODE=debug --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen:v9.11.1 -r /app -o /app/bom.json

No errors/warnings without debug mode. Can these warnings be ignored? or there might be some missing dependencies?

[prabhu]

@priyasharma127 Invalid refs are known bugs in cdxgen. If it could be replicated with a public repo you can file an issue but it will be fixed at a slow pace since they can be ignored usually