Package the cyclonedx-cli tool for testing purpose

[ErinvanderVeen]

Especially the cyclonedx validate --input-file <PATH> is a very good one. This one validates the provided json file against the cyclonedx spec, and is how I caught multiple non-conformities.

[raboof]

Interesting! I started on this in NixOS/nixpkgs#197689 at some point, but IIRC validating with https://github.com/python-jsonschema/check-jsonschema against https://github.com/CycloneDX/specification/blob/master/schema/bom-1.5.schema.json provided more useful error messages for me. Did you find the tool improved or catches errors not found by just validating against the schema?

[ErinvanderVeen]

Hoi @raboof!

I did not even consider testing against the schema (stupid me), and agree with you that your proposed way provides much, much better feedback than the cyclonedx-cli tool. With that, I think cyclonedx-cli is still worth keeping for CI purposes. As an "official" tool, I feel it has a lot of authority.

However, I'll absolutely also include a check against the schema.

[ErinvanderVeen]

The cyclonedx-cli tool doesn't return a non-zero error code when validation fails...