BOM generation is not valid

[simonfrancaix]

Description

When generating a SBOM in cyclonedx format with trivy cli, the output file is not valid.

This bug occurred for the image mcr.microsoft.com/playwright/java:v1.47.0-noble-amd64

Desired Behavior

A valid SBOM for the image mcr.microsoft.com/playwright/java:v1.47.0-noble-amd64

Actual Behavior

An invalid SBOM

Reproduction Steps

1. trivy image --format cyclonedx --output /tmp/playwright.json mcr.microsoft.com/playwright/java:v1.47.0-noble-amd64
2. cyclonedx-cli validate --input-file /tmp/playwright.json

Target

None

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Debug Output

$ cyclonedx validate --input-file /tmp/playwright.json
Validation failed:
...

Operating System

Ubuntu 22.04 LTS

Version

$ trivy --version                                                                                                   
Version: 0.56.1
Java DB:
  Version: 1
  UpdatedAt: 2024-10-10 03:13:49.095108285 +0000 UTC
  NextUpdate: 2024-10-13 03:13:49.095108165 +0000 UTC
  DownloadedAt: 2024-10-10 09:16:52.829307614 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting