Error after v10.8.0

[aguillen-osp]

After v10.8.0 the command with options -t universal -o sbom.json started failing with error Manifest file ... was not found after export at .... What could be the problem?

[prabhu]

Does it work with the previous version? Could you run it with the environment variable CDXGEN_DEBUG_MODE=debug and share the full output?

[prabhu]

@aguillen-osp, are you able to come up with a sample repo to reproduce the problem? Could you also run both the versions with the DEBUG environment variable and share the output?

[prabhu]

Also note that depscan 5.x needs a fixed version, which is 10.7.1. We don't have any plans to support 10.8.x onwards with depscan 5.x.

[prabhu]

Please retest with the latest 10.8.2

[aguillen-osp]

The BOM using the new v10.8.2 seems to be including all components and dependencies as in v10.7.1. Thank you so much for taking a look and manage to produce the patch with little input from my side!

As a side note, what do you mean with this?

Also note that depscan 5.x needs a fixed version, which is 10.7.1. We don't have any plans to support 10.8.x onwards with depscan 5.x.

Should we take any action if we want to benefit from that report?

[prabhu]

Thanks. depscan v6 will support cdxgen 11.x. Based on time, we might do a backport and release depscan 5.6.x to support cdxgen 10.8.x, especially the multi type and exclude type feature.