syft generates SBOMs that don't meet SPDX spec

[surendrapathak]

While applying sbomqs quality checks on SBOMs, we found issues with syft-generated SBOMs.

For spdx-json, syft generates SBOMs that do not adhere to the SPDX spec.

What happened:

syft packages python:3.9.15-bullseye -o spdx-json > ~/Downloads/python-3.9.15-bullseye.spdx.json

The generated SBOM has a "files" section at line: 20350

However, none of the included 'file' has 'checksum', a required field

https://spdx.github.io/spdx-spec/v2.2.2/file-information/#84-file-checksum-field

What you expected to happen:

Generated SPDX to be a valid SPDX 2.2 document.

Anything else we need to know?:

Environment:

• Output of syft version:

Application:        syft
Version:            0.65.0
JsonSchemaVersion:  6.0.0
BuildDate:          2023-01-04T17:00:24Z
GitCommit:          bc1edb9c8a2fb4824bfdcac6147edc2bbf47aaf6
GitDescription:     v0.65.0
Platform:           darwin/amd64
GoVersion:          go1.18.9
Compiler:           gc```

- OS (e.g: `cat /etc/os-release` or similar):
Mac 13.1

[tgerla]

Possibly related to #1401

[kzantow]

Hi @surendrapathak you are correct, by default Syft does not generate checksums which results in invalid SDPX documents. You can, however, run Syft with the environment variables: SYFT_FILE_METADATA_CATALOGER_ENABLED=true SYFT_FILE_METADATA_DIGESTS=sha1 to cause the required SHA1 hashes to be calculated and included for files as well as PackageVerificationCode, e.g.:

SYFT_FILE_METADATA_CATALOGER_ENABLED=true SYFT_FILE_METADATA_DIGESTS=sha1 syft alpine:latest -o spdx

[spiffcs]

Adding a link to where we test for this in our cli suite:
https://github.com/anchore/syft/blob/main/test/cli/spdx_tooling_validation_test.go