SBOM generation issue cdxgen binary

[hnaung]

Greetings!

I used cdxgen binary and cdxgen container to generate SBOM for vendor-binaries. It works partially, especially for "jar" files but other binaries are not working at all.

However, when I setup cdxgen as a container server and generate SBOM inside that cdxgen container server, it does works for "jar" files as well as other binaries. Any suggestions or insights would be highly appreciated.

[prabhu]

@hnaung Could you investigate with a colleague and triage this further? Issues are only for reporting bugs that can be reproduced.

[hnaung]

Hi @prabhu, Thanks for your response. I did some further investigation and noticed a key difference:

When running cdxgen as a container server, it appears that cdxgen inside the container is executed via deno along with some npm command npm: @CycloneDX/cdxgen/cdxgen. This setup seems to handle SBOM generation correctly for different binaries (including jar files).

However, when running the standalone cdxgen binary directly, it doesn't produce the expected SBOM output for all the vendor binaries such as "sbom-tool-linux-64", "cycloneDX-cli" and etc.

All the vendor binaries SBOM generation is working as expected in cdxgen container server.

[root@808600ad9c31 app]#
[root@808600ad9c31 app]# which cdxgen
/root/.deno/bin/cdxgen
[root@808600ad9c31 app]# cat /root/.deno/bin/cdxgen
#!/bin/sh
# generated by deno install
exec deno run --allow-read --allow-write --allow-net --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid,homedir --no-config --lock /root/.deno/bin/.cdxgen.lock.json 'npm:@cyclonedx/cdxgen/cdxgen' "$@"
[root@808600ad9c31 app]#

Standalone cdxgen binary SBOM output for vendor binaries.

{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:9072a005-43ec-4414-9a5d-aff2e098adfe","version":1,"metadata":{"timestamp":"2025-03-19T10:02:20Z","tools":{"components":[{"group":"@cyclonedx","name":"cdxgen","version":"11.2.2","purl":"pkg:npm/%40cyclonedx/[email protected]","type":"application","bom-ref":"pkg:npm/@cyclonedx/[email protected]","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"properties":[]},"components":[],"services":[],"dependencies":[],"annotations":[]}

Both tests were performed on RHEL9 machine.

Thank you for your input and insights on this! Looking forward to any further thoughts or guidance.