Dependency Graph Information Missing in CycloneDX SBOMs

[twright-0x1]

This has a tangential relation to the earlier issue #3906.

When I use ort to generate an sbom, if the sbom type is SPDX, I see dependency graph information (at the end of the SBOM file). Whereas, if I select CycloneDX as the type, it appears that dependency graph information is missing.

My test case is a clone of the WebGoat project. I'm using a Docker install of ort... If I generate an Analyzer file with:

docker run --rm -v /MyStuff/:/project ort --info analyze -i /project/WebGoat --output-dir /project

and then an SPDX SBOM with:

docker run --rm -v /MyStuff/:/project ort --info report -i /project/analyzer-result.yml -f SpdxDocument -o /project

I see the expected dependency graph information at the end of the file. E.g., here's a snippet:

relationships:
- spdxElementId: "SPDXRef-Package-Maven-cglib-cglib-nodep-2.2"
  relationshipType: "GENERATED_FROM"
  relatedSpdxElement: "SPDXRef-Package-Maven-cglib-cglib-nodep-2.2-source-artifact"
- spdxElementId: "SPDXRef-Package-Maven-ch.qos.logback-logback-classic-1.2.11"
  relationshipType: "DEPENDS_ON"
  relatedSpdxElement: "SPDXRef-Package-Maven-ch.qos.logback-logback-core-1.2.11"

Whereas, if I generate a CycloneDX SBOM with:

docker run --rm -v /MyStuff/:/project ort --info report -i /project/analyzer-result.yml -f CycloneDx -o /project

I don't find any dependency data.

[sschuberth]

This has a tangential relation to the earlier issue #3906.

Mind explaining why only "tangential"? I'd say this is an exact duplicate... or am I missing something?

[twright-0x1]

Apologies if that was a poor selection of word. My thinking was that #3906 had a Maven focus. I'm seeing the missing graph information for projects like WebGoat and Bootstrap...so, not just Maven.

[sschuberth]

My thinking was that #3906 had a Maven focus.

Just curious, how that? That issue does not even mention the word "Maven" 😉

Anyway, #3906 is meant to be package-manager-agnostic (like any ORT report format is). So are we good to close this as a duplicate?

[twright-0x1]

Sure thing! Happy to see this issue is considered relevant, still.