Ability to specify cyclonedx format version

[anderius]

Description

I have a tool that only supports up to cyclonedx 1.4, and trivy image is generating 1.5.

It would be nice to have the option to specify desired output schema version!

Target

SBOM

Scanner

None

[knqyf263]

You can use older versions of Trivy.

[anderius]

Of course, that is a temporary workaround. But I would like to update trivy as well, as for example the breaking change of the java db required (https://github.com/aquasecurity/trivy/releases/tag/v0.37.2). Also, I guess other fixes and improvements are coming, that I don't want to miss! :-)

[knqyf263]

It is hard for Trivy to maintain several versions. You can ask the tool to support v1.5.

[AnaisUrlichs]

@anderius not sure if it's possible but you could write a trivy plugin that allows you to change the cyclonedx format version or just use the trivy older version when you want to generate the SBOM and the newer version for your other use cases

[anderius]

The library you use, go-cyclonedx, supports multiple versions, so it should not be impossible. :-)

The tool I use (Nexus IQ) already supports multiple versions, just not the latest (yet). If you support only one version, maybe you should allow some more time before adopting? Version 1.5 arrived this summer, as far as I know.

I also found converting tools, but, again, they don't support the latest version (yet).

[knqyf263]

The library you use, go-cyclonedx, supports multiple versions, so it should not be impossible. :-)

The data structure is different depending on the version, not only the version number. Of course, it is not impossible, but that maintenance could cost us.

[Caleb-Bugnacki]

Would love to see this implemented as well. Running into issues where the tools I am using against my trivy generated SBOMs don't yet support the latest and greatest cyclonedx version that Trivy quickly adopts.