List of issues discovered with Open Source SBOM generators

[surendrapathak]

CPython SBOM: Still in development

• PackageVerificationCode is a required field with filesAnalyzed:true sethmlarson/cpython-sbom#5
• PackageSupplier is missing from the SBOM sethmlarson/cpython-sbom#6
• SBOM is missing vulnerability lookup identifiers (CPE/PURL) for packages sethmlarson/cpython-sbom#7
• SBOM created field does not match the specification sethmlarson/cpython-sbom#8

Github SBOM

• Invalid PURL value advanced-security/gh-sbom#17
• Invalid SPDXID: SPDXRef-actions-actions/checkout-3 advanced-security/gh-sbom#16
• versionInfo is incorrect for a github reference advanced-security/gh-sbom#15
• Invalid purl type: githubactions advanced-security/gh-sbom#14
• versionInfo value is incorrect advanced-security/gh-sbom#13
• documentDescribes is deprecated with SPDX version 2.3.1 advanced-security/gh-sbom#12
• The tool name does not include the version. advanced-security/gh-sbom#11

Aqua Trivy

• [SPDX][JSON] SBOM required field 'checksum' is missing/incorrect aquasecurity/trivy#3748
• [SPDX][TV/JSON] SBOM required field 'Creator' is missing/incorrect aquasecurity/trivy#3707
• SPDX2.2: trivy generates SBOM without required PackageDownloadLocation aquasecurity/trivy#3601
• SPDX2.2: trivy generates SBOM with invalid values for PackageLicenseConcluded/PackageLicenseDeclared aquasecurity/trivy#3622
• SPDX2.2: trivy generates SBOM with unsupported time format aquasecurity/trivy#3600
• CDX1.4: trivy generates SBOM with invalid value for components aquasecurity/trivy#3623
• CDX1.4: trivy generates SBOM with incomplete reference in vulnerability aquasecurity/trivy#3625

Anchore Syft

• [SPDX][TV] SBOM value format is incorrect for LicenseID anchore/syft#1651
• Invalid SPDX generated for flagger anchore/syft#1616
• syft generates SBOMs that don't meet SPDX spec anchore/syft#1568
• [SPDX][TV] SBOM value format is incorrect for ExtractedText anchore/syft#1641
• [SPDX][TV] SBOM value format is incorrect for LicenseName anchore/syft#1642

Kubernetes BOM: The SBOM Multitool

• [SPDX][TV/JSON] SBOM required field 'Creator' is missing/incorrect kubernetes-sigs/bom#235
• SPDX2.2: bom generates SBOM with invalid value for packageVerificationCodeValue kubernetes-sigs/bom#230

Microsoft SBOM Tool

• SBOMTool produces invalid SPDX SBOM file for licenseInfoFromFiles for PowerShell microsoft/sbom-tool#216
• SBOMTool produces invalid SPDX SBOM file for supplier for PowerShell microsoft/sbom-tool#217

Tern

• [SPDX][JSON] SBOM value format is incorrect for licenseDeclared tern-tools/tern#1224

CMake-SPDX

SPDX SBOM Generator

• [SPDX][TV] SBOM value format is incorrect for PackageComment opensbom-generator/spdx-sbom-generator#284
• [SPDX][TV] SBOM value format is incorrect for PackageLicenseComments opensbom-generator/spdx-sbom-generator#285

Cyclonedx Python SBOM Generator

Fatbom

• Invalid SPDX published for fatbom project VexStore/fatbom#4

Tools

• SPDX tag-value parsing fails for CRLF terminated file spdx/tools-golang#198
• SPDX tag-value parsing fails for ExternalDocumentRef in document. spdx/tools-golang#195
• PackageVersion with ":" are considered invalid token spdx/tools-python#479

Others

• Invalid SPDX generated with the release fluxcd/flagger#1379
• PowerShell produces invalid SPDX SBOM file for licenseInfoFromFiles PowerShell/PowerShell#19210
• bomber published SBOM is incorrectly labeled and has suspicious product name devops-kung-fu/bomber#132
• Invalid document checked in as sbom maubot/maubot#205
• PowerShell produces invalid SPDX SBOM file for supplier PowerShell/PowerShell#19211