The --include-crypto option doesn't produce a CBOM on a Java file

[joe-ratzer]

Hi. I am trying the CBOM option (--include-crypto), but it doesn't appear to work.

When I try this:
cdxgen -t java -o .bom.json ./src

the bom file is created fine.

But changing it to this:
cdxgen -t java --include-crypto -o bom.json ./src

creates an error message: "Bom file doesn't exist. Check if cdxgen was invoked with the correct type argument."

The source file is a very basic java file, with less than 10 lines of code.

Am I using the command incorrectly? I used the --include-crypto example from here - https://github.com/CycloneDX/cdxgen

[prabhu]

@joeratzer could you change to src directory and try

cd src
cdxgen -t java --include-crypto -o bom.json

atom will look for the bom file from the root directory of the folder being scanned.

[prabhu]

@joeratzer awesome. Could you share your test repo, so that we can investigate?

[joe-ratzer]

Hi @prabhu, ok - I've just pushed this simple repo - https://github.com/joeratzer/obsolete-hashing-java-app

I also created a maven project with mvn archetype:generate, which contains example java code, but that didn't work with cdxgen either. So I have abandoned that.

It would be good if https://github.com/joeratzer/obsolete-hashing-java-app could work.

[prabhu]

@joeratzer Thanks for the repo. The auto tagging performed by atom via chen is based on sbom. There must be a pom.xml or build.gradle for things to work. Can you find more complete examples that use a package manger for now?

I can show manual tagging and querying for package less applications using chennai, but that is beyond the scope for cdxgen or cbom.

[joe-ratzer]

Hi @prabhu - ok thanks, I will add a package manager to that repo and try again.

But shouldn't the test project from mvn archetype:generate work then?

[prabhu]

@joeratzer it depends on the bom components generated. Is there at least one component?