False Validation of Syft/Grype SBOM

[pkiesslingsonatype]

I created an SBOM using Syft/Grype and it should have created a valid CycloneDX 1.4 SBOM. The SBOM did not adhere to the CycloneDX 1.4 schema, however the CycloneDX CLI validated it successfully regardless.

To reproduce:

https://github.com/anchore/syft
https://github.com/anchore/grype

syft nodered/node-red -o cyclonedx-xml --file bom.xml
grype sbom:bom.xml -o cyclonedx --file grype-bom.xml
cyclonedx validate --input-file grype-bom.xml

Result: Validated successfully
Expected result: Not valid

[andreas-hilti]

@pkiesslingsonatype Can you please specify how it violates the schema?
Maybe I missed the obvious... but it is a bit hard with a 19k lines document. (By now it produced a version 1.5 schema, but I'm not sure whether this matters.)
As a side note, all that the cli does at the moment is to validate the xml schema.

[spiffcs]

Related local issue here: #344
Related syft issue where we did the investigation: anchore/syft#2268

For the images supplied we found that the schema should be updated with the latest SPDX license list.

[pkiesslingsonatype]

@andreas-hilti It seems the URLs within the SBOM do not comply with the schema:

xmllint --noout --schema ~/Downloads/bom-1.4.xsd grype-bom.xml
grype-bom.xml:3612: element url: Schemas validity error : Element '{[http://cyclonedx.org/schema/bom/1.4}url](http://cyclonedx.org/schema/bom/1.4%7Durl)': '[email protected]:colorjs/color-name.git' is not a valid value of the atomic type 'xs:anyURI'.
grype-bom.xml:5946: element url: Schemas validity error : Element '{[http://cyclonedx.org/schema/bom/1.4}url](http://cyclonedx.org/schema/bom/1.4%7Durl)': '[email protected]:follow-redirects/follow-redirects.git' is not a valid value of the atomic type 'xs:anyURI'.
grype-bom.xml:8857: element url: Schemas validity error : Element '{[http://cyclonedx.org/schema/bom/1.4}url](http://cyclonedx.org/schema/bom/1.4%7Durl)': '[email protected]:jprichardson/node-jsonfile.git' is not a valid value of the atomic type 'xs:anyURI'.
grype-bom.xml:14669: element url: Schemas validity error : Element '{[http://cyclonedx.org/schema/bom/1.4}url](http://cyclonedx.org/schema/bom/1.4%7Durl)': '[email protected]:lupomontero/psl.git' is not a valid value of the atomic type 'xs:anyURI'.
grype-bom.xml fails to validate

I have attached the SBOM that is causing the issue.
Hopefully that helps.
grype-bom.xml.zip

[spiffcs]

Oh! Thanks for the extra info @pkiesslingsonatype - I can probably get a fix in grype that updates those URL to be correct

[andreas-hilti]

@pkiesslingsonatype When I produced the SBOM myself, it contained none of these "[email protected]" urls.