diff --git a/src/cyclonedx/Commands/MergeCommand.cs b/src/cyclonedx/Commands/MergeCommand.cs index 7a96404..bd3aefe 100644 --- a/src/cyclonedx/Commands/MergeCommand.cs +++ b/src/cyclonedx/Commands/MergeCommand.cs @@ -89,7 +89,9 @@ public static async Task Merge(MergeCommandOptions options) } else { - // otherwise use the first non-null component from the input BOMs as the default + // otherwise use the first non-null component from the input + // BOMs as the default; note CleanupMetadataComponent() below + // to ensure that such bom-ref exists in the document only once. foreach (var bom in inputBoms) { if(bom.Metadata != null && bom.Metadata.Component != null) @@ -101,8 +103,19 @@ public static async Task Merge(MergeCommandOptions options) } } + outputBom = CycloneDXUtils.CleanupMetadataComponent(outputBom); + outputBom = CycloneDXUtils.CleanupEmptyLists(outputBom); + outputBom.Version = 1; outputBom.SerialNumber = "urn:uuid:" + System.Guid.NewGuid().ToString(); + if (outputBom.Metadata is null) + { + outputBom.Metadata = new Metadata(); + } + if (outputBom.Metadata.Timestamp is null) + { + outputBom.Metadata.Timestamp = DateTime.Now; + } if (!outputToConsole) {