# Components missing from CycloneDX json format SBOM when generation is part of a test **URL:** \ **Category:** Syft\ **Created:** [September 8, 2025, 10:25am UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553 "2025-09-08T10:25:45Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![danrollason](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@danrollason](https://anchorecommunity.discourse.group/u/danrollason)\ **Post date:** [September 8, 2025, 10:25am UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553/1 "2025-09-08T10:25:45Z")
Hi, We are using Syft as a library to generate CycloneDX json format SBOMs. Our code runs on a scratch container and works fine. We added a /tmp directory to the scratch container and in our example generates a 2000+ line sbom json file full of components. When we run the same code as part of a test (go test), this time running on a container based on a RedHat ubi minimal image, we get a very small sbom file with only the meta data and no components. The container running the test has a /tmp directory. There are no errors, warnings or info messages to indicate the issue. If we run the test locally on our laptops we get the full file with components. Given that the test runs locally and that the code can run correctly on a scratch container (with /tmp) it would appear that something on the ubi container is causing the problem. Is there anything aside from a missing /tmp that could cause this issue or has anybody experienced something similar. Thanks Dan ---
**Author:** ![westonsteimel](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/westonsteimel/32/470_2.png) [@westonsteimel](https://anchorecommunity.discourse.group/u/westonsteimel)\ **Post date:** [September 8, 2025, 10:37am UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553/2 "2025-09-08T10:37:15Z")
Hello, which version of syft are you using? In the latest [v1.32.0](https://github.com/anchore/syft/releases/tag/v1.32.0) release we added a warning if the required sqlite driver hasn’t been registered when using syft as a library: [chore: redhat cataloger error when sqlite not regsitered by kzantow · Pull Request #4150 · anchore/syft · GitHub](https://github.com/anchore/syft/pull/4150). That could result in rpm packages not being cataloged as expected ---
**Author:** ![danrollason](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@danrollason](https://anchorecommunity.discourse.group/u/danrollason)\ **Post date:** [September 8, 2025, 10:41am UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553/3 "2025-09-08T10:41:16Z")
We are on 1.30.0. We’ll update and see what happens. ---
**Author:** ![danrollason](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@danrollason](https://anchorecommunity.discourse.group/u/danrollason)\ **Post date:** [September 8, 2025, 10:55am UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553/4 "2025-09-08T10:55:41Z")
We updated to 1.32 and received the message about Sqlite. We add an import for [modernc.org/sqlite](http://modernc.org/sqlite) to the test. The sqlite message has now gone but we are still generating the very short sbom. ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [September 8, 2025, 1:13pm UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553/5 "2025-09-08T13:13:14Z")
Are you doing an image scan in one case vs a directory scan in the other? There are a different set of catalogers that run by default for these cases. If you run `syft cataloger list` you can see which catalogers are run for `directory` and which are for `image`. If that doesn’t happen to be the problem, we’ll need some more info to get to the bottom of this. A sample program and some steps to run on either type of image would probably let us see what the difference is fairly quickly. ---
**Author:** ![danrollason](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@danrollason](https://anchorecommunity.discourse.group/u/danrollason)\ **Post date:** [September 9, 2025, 2:18pm UTC](https://anchorecommunity.discourse.group/t/components-missing-from-cyclonedx-json-format-sbom-when-generation-is-part-of-a-test/553/6 "2025-09-09T14:18:40Z")
In both cases the code executing is the same - building a CycloneDX1.4 json file from an oci-archive tar file. We have been unable to produce a test case. For every scenario we have tried, the code produces the correct output. The only place it behaves incorrectly is running in a pipeline on our Openshift cluster. We are completely out of ideas on how to debug this further so will skip running this test on the cluster. Thanks