Schema validation failed on importing SBOM

[nigellh]

Running the latest version of DT. I have an SBOM that I have validated against 2 separate validation tools and both report it as valid. On importing it I am getting:

On viewing the logs I get:

apiserver-1 | 2024-12-24 12:31:21,603 INFO [ProjectResource] Project nps-onprem created by nhopper [requestId=a5461b77-ec83-4a28-ba7e-0849d29100f4]

And that is the last log entry! There is nothing about why the schema failed. I have tried two different servers (one a slightly earlier version) and the same on both of them.

Unfortunately, I cannot share the SBOM, but any guidance as to forcing the logs to give more or what to look for would help. It is extremely rare for the tool that generates these SBOMs to do this and one I created at the same time imported perfectly.

Many thanks and have a great festive time of the year if you can!!!!!!

[nigellh]

Did an experiment. I deleted all the:

• license data
• copyright data
• download URL data
• notes data

Created an SBOM from that and it imported. So I am guessing it is a character in one of these fields that it cannot handle.

Now to delete them one at a time to figure out which!

[nigellh]

It is the download URL data. Now to see if I can narrow it further.

[nigellh]

This is the problem entry:

    {
      "type": "library",
      "bom-ref": "pkg:pypi/[email protected]",
      "supplier": {
        "url": [
          "Not Found"
        ]
      },
      "author": "UNKNOWN",
      "name": "example",
      "version": "21.12",
      "description": "UNKNOWN",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "copyright": "No copyright found",
      "purl": "pkg:pypi/[email protected]",
      "properties": [
        {
          "name": "Relationship Completeness",
          "value": "Unknown"
        }
      ]
    },

This is the fixed one:

    {
      "type": "library",
      "bom-ref": "pkg:pypi/[email protected]",
      "supplier": {
        "url": [
          ""
        ]
      },
      "author": "UNKNOWN",
      "name": "example",
      "version": "21.12",
      "description": "UNKNOWN",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "copyright": "No copyright found",
      "purl": "pkg:pypi/[email protected]",
      "properties": [
        {
          "name": "Relationship Completeness",
          "value": "Unknown"
        }
      ]
    },

The difference is:

  "supplier": {
    "url": [
      "Not Found"
    ]
  },

https://cyclonedx.org/docs/1.5/json/#components_items_supplier_url

Is the reference. I am guessing DT is enforcing the fact that it needs to be a URL, but there is nothing in the logs to show why it is an error.

Can something be done to get the logs to show the error.