Example SBOM available?

[mhadavan]

Hi!

I have a instance of DT now, where I'm playing around do learn.

But I have a hard time to get it to work, to make DT show any CVEs.
I have exported a sbom from docker scout, that contains some components with known CVEs.
This I have imported into a DT project, but no CVE's are visible.

So my question is:
Can someone point out a sbom that shall show CVEs after import into DT?
I just want to verify my installation with this.

[nscuro]

We publish our own BOMs with every release as bom.json: https://github.com/DependencyTrack/dependency-track/releases

Pick one from an old release.

[mhadavan]

Ohh! Thanks, will give it a try!

[mhadavan]

I have now uploaded the sbom from release 4.0.0.
According to my DT instance, it contains 163 componens, and zero CVEs....

Can someone else try this also? I really do not belive the zero CVE number that my instance gives me.

I'm using 4.14.1