CycloneDX BOM generated is invalid

[simonfrancaix]

Description

CycloneDX BOM generation is not valid for the image mcr.microsoft.com/playwright/java:v1.47.0-noble-amd64

Desired Behavior

Valid CycloneDX BOM

Actual Behavior

Invalid CycloneDX BOM

Reproduction Steps

1. trivy image --format cyclonedx --output /tmp/playwright.json mcr.microsoft.com/playwright/java:v1.47.0-noble-amd64
2. cyclonedx-cli validate --input-file playwright.json

Target

None

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Debug Output

$ cyclonedx-cli validate --input-file /tmp/playwright.json
Validation failed:
[...]
Unable to validate against any JSON schemas.
BOM is not valid.

Operating System

Ubuntu 22.04 LTS

Version

$ trivy --version
Version: 0.56.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-10 06:15:55.415626797 +0000 UTC
  NextUpdate: 2024-10-11 06:15:55.415626527 +0000 UTC
  DownloadedAt: 2024-10-10 09:31:42.168750862 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-10-10 03:13:49.095108285 +0000 UTC
  NextUpdate: 2024-10-13 03:13:49.095108165 +0000 UTC
  DownloadedAt: 2024-10-10 09:16:52.829307614 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

@DmitriyLewen Can you please take a quick look?

[DmitriyLewen]

Hello @simonfrancaix
I think that this is bug in `cyclonedx-cli.

Value is "object" but should be "array"
http://cyclonedx.org/schema/bom-1.6.schema.json#/properties/tools/oneOf/1
On instance: /metadata/tools:
{
      "components": [
        {
          "type": "application",
          "group": "aquasecurity",
          "name": "trivy",
          "version": "0.55.2"
        }
      ]
    }

tools array is deprecated. Tools is object now - https://cyclonedx.org/docs/1.6/json/#tab-pane_metadata_tools_oneOf_i0

Required properties ["id"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/0
On instance: /components/510/licenses/0/license:
{
            "name": "GPL-3.0"
          }

License can be id or name - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i0_items_license_oneOf_i1

Value should have at most 1 items
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1
On instance: /components/313/licenses:
[
        {
          "license": {
            "name": "BSD-3-Clause"
          }
        },
        {
          "license": {
            "name": "ISC"
          }
        },
        {
          "license": {
            "name": "GPL-3.0"
          }
        }
      ]

Licenses is array - why should it be one item? https://cyclonedx.org/docs/1.6/json/#components_items_licenses