Skip to content

fix output sbom schema - #336

Merged
riteshnoronha merged 2 commits into
interlynk-io:mainfrom
viveksahu26:fix/sbom-schema
Aug 7, 2026
Merged

fix output sbom schema#336
riteshnoronha merged 2 commits into
interlynk-io:mainfrom
viveksahu26:fix/sbom-schema

Conversation

@viveksahu26

@viveksahu26 viveksahu26 commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

closes #328

This PR adds the following changes:

  • correct schema as per provided --outputSpecVersion
  • Added integration test for the same.

Example:

$ go run main.go assemble --augmentMerge --primary  samples/test/assemble/lite-sbom1-cdx.json samples/test/assemble/lite-sbom2-cdx.json -o augment-Merge-default-default-version.cdx-new.json

$ go run main.go assemble --augmentMerge --primary  samples/test/assemble/lite-sbom1-cdx.json samples/test/assemble/lite-sbom2-cdx.json -o augment-Merge-default-16.cdx-new.json --outputSpecVersion=1.6

$ go run main.go assemble --augmentMerge --primary  samples/test/assemble/lite-sbom1-cdx.json samples/test/assemble/lite-sbom2-cdx.json -o augment-Merge-default-15.cdx-new.json --outputSpecVersion=1.5

$ go run main.go assemble --augmentMerge --primary  samples/test/assemble/lite-sbom1-cdx.json samples/test/assemble/lite-sbom2-cdx.json -o augment-Merge-default-14.cdx-new.json --outputSpecVersion=1.4

Now validate schema using sbomqs:

$ sbomqs score -f sbom_schema_valid augment-Merge-default-default-version.cdx-new.json
Feature Quality Score: 10.0/10.0     Grade: A    Components: 6      EngineVersion: 8    File: augment-Merge-default-default-version.cdx-new.json

Feature Breakdown:
+-------------------+-----------+-------+----------+
|      FEATURE      |   SCORE   | GRADE |   DESC   |
+-------------------+-----------+-------+----------+
| sbom_schema_valid | 10.0/10.0 | A     | complete |
+-------------------+-----------+-------+----------+

$ sbomqs score -f sbom_schema_valid augment-Merge-default-16.cdx-new.json             
Feature Quality Score: 10.0/10.0     Grade: A    Components: 6      EngineVersion: 8    File: augment-Merge-default-16.cdx-new.json

Feature Breakdown:
+-------------------+-----------+-------+----------+
|      FEATURE      |   SCORE   | GRADE |   DESC   |
+-------------------+-----------+-------+----------+
| sbom_schema_valid | 10.0/10.0 | A     | complete |
+-------------------+-----------+-------+----------+

$ sbomqs score -f sbom_schema_valid augment-Merge-default-15.cdx-new.json
Feature Quality Score: 10.0/10.0     Grade: A    Components: 6      EngineVersion: 8    File: augment-Merge-default-15.cdx-new.json

Feature Breakdown:
+-------------------+-----------+-------+----------+
|      FEATURE      |   SCORE   | GRADE |   DESC   |
+-------------------+-----------+-------+----------+
| sbom_schema_valid | 10.0/10.0 | A     | complete |
+-------------------+-----------+-------+----------+

$ sbomqs score -f sbom_schema_valid augment-Merge-default-14.cdx-new.json
Feature Quality Score: 10.0/10.0     Grade: A    Components: 6      EngineVersion: 8    File: augment-Merge-default-14.cdx-new.json

Feature Breakdown:
+-------------------+-----------+-------+----------+
|      FEATURE      |   SCORE   | GRADE |   DESC   |
+-------------------+-----------+-------+----------+
| sbom_schema_valid | 10.0/10.0 | A     | complete |
+-------------------+-----------+-------+----------+

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>
Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>
@riteshnoronha
riteshnoronha merged commit ccd8dea into interlynk-io:main Aug 7, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Set specific SpecVersion during augmentMerge

2 participants