[ingestion/data-quality issue] CycloneDX specification as of 1.4 does not require the component field in metadata

[pxp928]

Describe the bug

Discovered by kurt-r2c in original PR #896:

The CycloneDX specification as of 1.4 does not require the component field in metadata, nor does it require the BOM ref field: https://cyclonedx.org/docs/1.4/json/#metadata_component_bom-ref.

guac was encountering a NPE when trying to read these uninitialized fields from the CycloneDX struct.

Some SBOM generators that only operate on package lockfiles (such as https://pypi.org/project/cyclonedx-bom/) do not generate the component metadata field, nor are they required to by the spec.

To Reproduce

ingestion of an SBOM that is generated by SBOM generators that only operate on package lockfiles (such as https://pypi.org/project/cyclonedx-bom/) that do not generate the component metadata field.

Expected behavior

Currently, output an error message that this is not currently supported as there would be no top-level package node and would result in a bunch of singleton packages. Further discussion and handling will need to be done to handle this use-case.

GUAC version
v0.1

[lumjjb]

@kurt-r2c wanted to check back here, want to see what other use cases we need to handle here that stemmed from discussion of this issue.

[joestein]

What more specifically needs to be added to the "component field in metadata" to make a CycloneDX file work? Do you have an example of what will work so folks can add that to their CycloneDX output and still make it work with GUAC (even if the spec doesn't support it no biggie to overlay the field post output from existing generators).

[pxp928]

Hey @joestein, at the minimum GUAC requires the following in the component field in the metadata:

guac/internal/testing/testdata/exampledata/alpine-cyclonedx.json

Lines 15 to 20 in e55fa24

	"component": {
	"bom-ref": "685d54d5e8f71d2f",
	"type": "container",
	"name": "docker.io/library/alpine:latest",
	"version": "sha256:cbaa390ec61abd889dfa5146a411c11717c19ef9e5e18458dbdc06439076ffe7"
	}

At the minimum, it needs the name, version, type, and bom-ref. If the purl is available, that would be the best as guac does not need to infer. Based on the CycloneDX spec the version and bom-ref are not required fields but provide a more accurate SBOM.

Without this information, GUAC cannot make proper relationships between the top-level component and its dependencies (resulting in a bunch of singletons).