Some CycloneDX SBOM files v.1.6 generated by trivy image are not compliant with cyclonedx validator #8615

AksuX · 2025-03-26T17:43:42Z

AksuX
Mar 26, 2025

Description

I found that the CycloneDX-JSON SBOM files generated from playwright docker image by Trivy are not compliant with the official CycloneDX schema.

I ran into this issue while working with license information and external tools like Dependency-Track that rely on schema compliance.

It appears to be quite the same issue as reported here: #4900

Desired Behavior

trivy produces SBOM file compliant with CycloneDX-JSON schema

Actual Behavior

trivy generates invalid SBOM JSON file.

Validation command:

cyclonedx validate --input-format json --fail-on-errors --input-version v1_6 --input-file playwright-sbom.json

Validation output:

Validating JSON BOM...
Validation failed:
Expected 1 matching subschema but found 0
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/licenseChoice
On instance: /components/52/licenses:
[
        {
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MIT/X11"
          }
        },
        {
          "license": {
            "name": "UNKNOWN"
          }
        },
        {
          "license": {
            "name": "GPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        },
        {
          "license": {
            "name": "MPL-1.1"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        },
        {
          "license": {
            "name": "BSD-3-Clause"
          }
        },
        {
          "license": {
            "name": "GPL-3.0-or-later"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-only"
          }
        },
        {
          "license": {}
        },
        {
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
      ]
Expected 1 matching subschema but found 0
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/licenseChoice
On instance: /components/199/licenses:
[
        {
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MIT/X11"
          }
        },
        {
          "license": {
            "name": "UNKNOWN"
          }
        },
        {
          "license": {
            "name": "GPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        },
        {
          "license": {
            "name": "MPL-1.1"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        },
        {
          "license": {
            "name": "BSD-3-Clause"
          }
        },
        {
          "license": {
            "name": "GPL-3.0-or-later"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-only"
          }
        },
        {
          "license": {}
        },
        {
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
      ]
Value should have at most 1 items
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1
On instance: /components/52/licenses:
[
        {
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MIT/X11"
          }
        },
        {
          "license": {
            "name": "UNKNOWN"
          }
        },
        {
          "license": {
            "name": "GPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        },
        {
          "license": {
            "name": "MPL-1.1"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        },
        {
          "license": {
            "name": "BSD-3-Clause"
          }
        },
        {
          "license": {
            "name": "GPL-3.0-or-later"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-only"
          }
        },
        {
          "license": {}
        },
        {
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
      ]
Value should have at most 1 items
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1
On instance: /components/199/licenses:
[
        {
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MIT/X11"
          }
        },
        {
          "license": {
            "name": "UNKNOWN"
          }
        },
        {
          "license": {
            "name": "GPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        },
        {
          "license": {
            "name": "MPL-1.1"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        },
        {
          "license": {
            "name": "BSD-3-Clause"
          }
        },
        {
          "license": {
            "name": "GPL-3.0-or-later"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-only"
          }
        },
        {
          "license": {}
        },
        {
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
      ]
Required properties ["expression"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0
On instance: /components/52/licenses/0:
{
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/1:
{
          "license": {
            "name": "MIT/X11"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/2:
{
          "license": {
            "name": "UNKNOWN"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/3:
{
          "license": {
            "name": "GPL-2.0-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/4:
{
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/5:
{
          "license": {
            "name": "MPL-1.1"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/6:
{
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/7:
{
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/8:
{
          "license": {
            "name": "BSD-3-Clause"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/9:
{
          "license": {
            "name": "GPL-3.0-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/10:
{
          "license": {
            "name": "LGPL-2.1-only"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/11:
{
          "license": {}
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/52/licenses/12:
{
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
Required properties ["expression"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0
On instance: /components/199/licenses/0:
{
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/1:
{
          "license": {
            "name": "MIT/X11"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/2:
{
          "license": {
            "name": "UNKNOWN"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/3:
{
          "license": {
            "name": "GPL-2.0-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/4:
{
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/5:
{
          "license": {
            "name": "MPL-1.1"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/6:
{
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/7:
{
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/8:
{
          "license": {
            "name": "BSD-3-Clause"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/9:
{
          "license": {
            "name": "GPL-3.0-or-later"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/10:
{
          "license": {
            "name": "LGPL-2.1-only"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/11:
{
          "license": {}
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/additionalItems
On instance: /components/199/licenses/12:
{
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0/additionalProperties
On instance: /components/52/licenses/0/license:
{
            "name": "LGPL-2.0-or-later"
          }
All values fail against the false schema
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1/items/0/additionalProperties
On instance: /components/199/licenses/0/license:
{
            "name": "LGPL-2.0-or-later"
          }
Expected 1 matching subschema but found 0
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/license
On instance: /components/52/licenses/11/license:
{}
Expected 1 matching subschema but found 0
http://cyclonedx.org/schema/bom-1.6.schema.json#/definitions/license
On instance: /components/199/licenses/11/license:
{}
Required properties ["id"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/0
On instance: /components/52/licenses/11/license:
{}
Required properties ["name"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1
On instance: /components/52/licenses/11/license:
{}
Required properties ["id"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/0
On instance: /components/199/licenses/11/license:
{}
Required properties ["name"] are not present
http://cyclonedx.org/schema/bom-1.6.schema.json#/oneOf/1
On instance: /components/199/licenses/11/license:
{}
BOM is not valid.

Reproduction Steps

1. trivy image --format cyclonedx -d mcr.microsoft.com/playwright:v1.50.0-noble > playwright-sbom.json

2. cyclonedx validate --input-format json --fail-on-errors --input-version v1_6 --input-file playwright-sbom.json

* Lot's of validation errors related to licenses - see "Actual Behavior - Validation output" above

BOM is not valid.

Target

Container Image

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Debug Output

$trivy image --format cyclonedx -d mcr.microsoft.com/playwright:v1.50.0-noble > playwright-sbom.json
2025-03-26T19:24:38+02:00	DEBUG	No plugins loaded
2025-03-26T19:24:38+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-03-26T19:24:38+02:00	DEBUG	Cache dir	dir="/Users/foo/Library/Caches/trivy"
2025-03-26T19:24:38+02:00	DEBUG	Cache dir	dir="/Users/foo/Library/Caches/trivy"
2025-03-26T19:24:38+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-03-26T19:24:38+02:00	DEBUG	Ignore statuses	statuses=[]
2025-03-26T19:24:38+02:00	INFO	"--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "cyclonedx" report.
2025-03-26T19:24:38+02:00	DEBUG	[pkg] Package types	types=[os library]
2025-03-26T19:24:38+02:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-03-26T19:24:38+02:00	DEBUG	Initializing scan cache...	type="fs"
2025-03-26T19:24:38+02:00	DEBUG	[image] Detected image ID	image_id="sha256:37646a0961bdc9dc96c1d7009b745047270a91be232d9ec825fa04b36a023af0"
2025-03-26T19:24:38+02:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:687d50f2f6a697da02e05f2b2b9cb05c1d551f37c404ebe55fdec44b0ae8aa5c sha256:80e1c3911303c7acec9112ee69a6f990c4fac699d0a9c9a65ffe1b07290682f1 sha256:17898b60bd647ac2fb9df2cb91c9c18296feed67303f22bf6521ad96a9d1ca31 sha256:dc162da5a01585eaf6d25d545dbd6be2cbb2b9ba1f90d795b387ac8e0f7acedc]
2025-03-26T19:24:38+02:00	DEBUG	[image] Detected base layers	diff_ids=[sha256:687d50f2f6a697da02e05f2b2b9cb05c1d551f37c404ebe55fdec44b0ae8aa5c]
2025-03-26T19:24:38+02:00	INFO	Detected OS	family="ubuntu" version="24.04"
2025-03-26T19:24:38+02:00	INFO	Number of language-specific files	num=1
2025-03-26T19:24:38+02:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-03-26T19:24:38+02:00	DEBUG	[vex] VEX filtering is disabled

Operating System

macos sequoia 15.3

Version

$ trivy --version
Version: 0.60.0

$ cyclonedx --version
0.27.2+f934c99826339cb8dbb83b439eb2c465fb253fb3

Checklist

Run trivy clean --all
Read the troubleshooting

Answered by DmitriyLewen

Mar 27, 2025

Created #8621

View full answer

AksuX · 2025-03-27T05:29:32Z

AksuX
Mar 27, 2025
Author

Relates to #4900

0 replies

DmitriyLewen · 2025-03-27T06:56:40Z

DmitriyLewen
Mar 27, 2025
Maintainer

Hello @AksuX
This problem related with License filed of Component.
As i wrote here - we use valid filed for licenses.

Cyclonedx-cli uses id in tests - https://github.com/CycloneDX/cyclonedx-cli/blob/f934c99826339cb8dbb83b439eb2c465fb253fb3/tests/cyclonedx.tests/Resources/bom-1.6.json#L99-L110
We use name.
But both cases are valid - https://cyclonedx.org/docs/1.6/json/#tab-pane_components_items_licenses_oneOf_i0_items_license_oneOf_i1

If you have more details about problem - let me know.

Regards, Dmitriy

2 replies

AksuX Mar 27, 2025
Author

It seems that in some of the playwright dependencies trivy creates "license": {} which is invalid and this causes the cyclonedx validator to go haywire.

Dependencies with invalid license:

gstreamer1.0-plugins-bad@1.24.2

{
      "bom-ref": "pkg:deb/ubuntu/gstreamer1.0-plugins-bad@1.24.2-1ubuntu4?arch=amd64&distro=ubuntu-24.04",
      "type": "library",
      "supplier": {
        "name": "Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>"
      },
      "name": "gstreamer1.0-plugins-bad",
      "version": "1.24.2-1ubuntu4",
      "licenses": [
        {
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MIT/X11"
          }
        },
        {
          "license": {
            "name": "UNKNOWN"
          }
        },
        {
          "license": {
            "name": "GPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        },
        {
          "license": {
            "name": "MPL-1.1"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        },
        {
          "license": {
            "name": "BSD-3-Clause"
          }
        },
        {
          "license": {
            "name": "GPL-3.0-or-later"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-only"
          }
        },
        {
          "license": {}
        },
        {
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
      ],

libgstreamer-plugins-bad1.0-0@1.24.2

    {
      "bom-ref": "pkg:deb/ubuntu/libgstreamer-plugins-bad1.0-0@1.24.2-1ubuntu4?arch=amd64&distro=ubuntu-24.04",
      "type": "library",
      "supplier": {
        "name": "Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>"
      },
      "name": "libgstreamer-plugins-bad1.0-0",
      "version": "1.24.2-1ubuntu4",
      "licenses": [
        {
          "license": {
            "name": "LGPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MIT/X11"
          }
        },
        {
          "license": {
            "name": "UNKNOWN"
          }
        },
        {
          "license": {
            "name": "GPL-2.0-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 LGPL-2+"
          }
        },
        {
          "license": {
            "name": "MPL-1.1"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-or-later"
          }
        },
        {
          "license": {
            "name": "MPL-1.1 GPL GPL-2+ LGPL"
          }
        },
        {
          "license": {
            "name": "BSD-3-Clause"
          }
        },
        {
          "license": {
            "name": "GPL-3.0-or-later"
          }
        },
        {
          "license": {
            "name": "LGPL-2.1-only"
          }
        },
        {
          "license": {}
        },
        {
          "license": {
            "name": "MPL-1.1 GPL"
          }
        }
      ],

IF I remove these invalid { "license": {} }, fields, THEN validation goes through.

DmitriyLewen Mar 27, 2025
Maintainer

Thanks for investigating.
cyclonedx-cli returned a lot of points, so I missed it.

DmitriyLewen · 2025-03-27T08:47:55Z

DmitriyLewen
Mar 27, 2025
Maintainer

Created #8621

0 replies

Navigation Menu

Uh oh!

Some CycloneDX SBOM files v.1.6 generated by trivy image are not compliant with cyclonedx validator #8615

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Some CycloneDX SBOM files v.1.6 generated by trivy image are not compliant with cyclonedx validator #8615

Uh oh!

Uh oh!

AksuX Mar 26, 2025

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 3 comments · 2 replies

Uh oh!

AksuX Mar 27, 2025 Author

Uh oh!

DmitriyLewen Mar 27, 2025 Maintainer

Uh oh!

AksuX Mar 27, 2025 Author

Uh oh!

DmitriyLewen Mar 27, 2025 Maintainer

Uh oh!

DmitriyLewen Mar 27, 2025 Maintainer

AksuX
Mar 26, 2025

Replies: 3 comments 2 replies

AksuX
Mar 27, 2025
Author

DmitriyLewen
Mar 27, 2025
Maintainer

AksuX Mar 27, 2025
Author

DmitriyLewen Mar 27, 2025
Maintainer

DmitriyLewen
Mar 27, 2025
Maintainer