CycloneDX 1.6 isn't widely supported; consider producing 1.5 again instead

[candrews]

Description

Trivy 0.5.3 now produces CycloneDX 1.6 SBOM's: #6902

However, tooling support for CycloneDX 1.6 is still spotty since it is so new. For example, cyclonedx-cli doesn't yet support it (#6902) nor does GitLab (see https://gitlab.com/gitlab-org/gitlab/-/issues/472837).

Desired Behavior

Can you please consider producing CycloneDX 1.5 again, or provide an option to specify the CycloneDX version for Trivy to produce?

Actual Behavior

Trivy produces CycloneDX 1.6 SBOMs which are not (yet) widely supported.

Reproduction Steps

n/a

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

n/a

Operating System

Linux

Version

Version: 0.53.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

It's not our bug. I've changed the category.
Since they have released v1.6, it is more sound for their tools to support v1.6 rather than other tools downgrading the version. We would only reconsider if there is something special about the situation that they cannot handle.

[dirsigler]

What about allowing different specs similar as Syft does it ?