Create SBOM file will have suffix in modules name

[106062]

Please provide a set of steps on how to reproduce the issue

syft packages file:path/to/yourproject/file -o cyclonedx-json

syft packages file:path/to/yourproject/file -o cyclonedx-xml

What happened:

modules name have suffix :*:*:*:*:*:*:*
What you expected to happen:

      "cpe": "cpe:2.3:a:yallist:yallist:4.0.0",
      "purl": "pkg:npm/[email protected]",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "javascript-lock-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "javascript"
        },
        {
          "name": "syft:package:type",
          "value": "npm"
        },
        {
          "name": "syft:cpe23",
          "value": "cpe:2.3:a:*:yallist:4.0.0"
        },
        {
          "name": "syft:location:0:path",
          "value": "package-lock.json"
        }
      ]

<component bom-ref="pkg:npm/[email protected]?package-id=20995d1e50ccb27a" type="library">
      <name>yallist</name>
      <version>4.0.0</version>
      <licenses>
        <license>
          <id>ISC</id>
        </license>
      </licenses>
      <cpe>cpe:2.3:a:yallist:yallist:4.0.0</cpe>
      <purl>pkg:npm/[email protected]</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:cpe23">cpe:2.3:a:*:yallist:4.0.0</property>
        <property name="syft:location:0:path">package-lock.json</property>
      </properties>
    </component>

Anything else we need to know?:

Environment:

• Output of syft version: v0.59.0
• OS (e.g: cat /etc/os-release or similar): VERSION="20.04.4 LTS (Focal Fossa)"

[kzantow]

Hi @106062 you're referring to a CPE, which should have all the CPE fields defined, in this case which ends with :*:*:*:*:*:*:*, which is required to be a valid CPE format (specifically, the "string binding format"). If you'd like to learn more about CPEs, please see: https://cpe.mitre.org/specification/