3.4.0 - ReferenceError: Name is required

[IonKiwi]

Upgraded from 3.3.1 to 3.4.0.
Running 3.4 results in the following error:

C:\Tools\node\node_modules@cyclonedx\bom\model\CycloneDXObject.js:35
if (required) { throw new ReferenceError(name + ' is required') }
^

ReferenceError: Name is required
at Component.validateType (C:\Tools\node\node_modules@cyclonedx\bom\model\CycloneDXObject.js:35:29)
at Component.set name [as name] (C:\Tools\node\node_modules@cyclonedx\bom\model\Component.js:276:23)
at new Component (C:\Tools\node\node_modules@cyclonedx\bom\model\Component.js:98:17)
at Bom.createMetadata (C:\Tools\node\node_modules@cyclonedx\bom\model\Bom.js:48:26)
at new Bom (C:\Tools\node\node_modules@cyclonedx\bom\model\Bom.js:39:29)
at C:\Tools\node\node_modules@cyclonedx\bom\index.js:33:15
at C:\Tools\node\node_modules\read-installed\read-installed.js:142:5
at C:\Tools\node\node_modules\read-installed\read-installed.js:263:14
at cb (C:\Tools\node\node_modules\slide\lib\async-map.js:47:24)
at C:\Tools\node\node_modules\read-installed\read-installed.js:263:14

OS: Windows Server 2019
NodeJS: 16.5.0
Command: cyclonedx-bom -o bom.js

[jkowalleck]

@IonKiwi please provide more details:

• the npm-lockfile that was used (upload/atack it to the issue)

[IonKiwi]

attached the lock file that was used
package-lock.zip

[jkowalleck]

@IonKiwi could you help understand the serup a bit more?

Maybe setup a repository with that package-lock and as minimal content as required, to reproduce the issue?
maybe add a README file in it, that describes the setup, the expectations, the observed behavior and so on?

[IonKiwi]

Also attached the package.json file.
package.zip

Steps to reproduce:
npm install -g @cyclonedx/bom
npm install (in the directory with the attached package.json)
cyclonedx-bom -o bom.js

with 3.3.1 that results in the sbom file, with 3.4.0 it results in the above error

[jkowalleck]

reproduced the error.

found the issue: the root component does not have a name - and is therefore invalid.

the package might be a private one, and have no name for that reason. also other required fields might be missing.

intended solution:

• the root component might miss some fields that are required for CycloneDX. therefore a bunch of fallback literals should be used instead of the missing information, so that the resulting data structures are valid.

additional tasks:

• add a test scenario there the name of the root component is empty -> see that it is filled in the result
• add additional exception handling
• add more verbose error text

[jkowalleck]

thanks for the report @IonKiwi .

I am working on a fix.

[jkowalleck]

fix was implemented. #253
ready for review&merge&release

[jkowalleck]

@IonKiwi a fix was released via 3.4.1
could you check?

[IonKiwi]

Great! can confirm that it's fixed