Pick up CycloneDX BOM components from metadata as well

cmd/syft/internal/test/integration/sbom_metadata_component_test.go

@@ -0,0 +1,25 @@
+package integration
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/source"
+)
+
+func TestSbomMetadataComponent(t *testing.T) {
+	sbom, _ := catalogFixtureImage(t, "image-sbom-metadata-component", source.SquashedScope, "+sbom-cataloger")
+
+	expectedPkgs := []string{"first-subcomponent", "main-component"}
+	foundPkgs := []string{}
+
+	for sbomPkg := range sbom.Artifacts.Packages.Enumerate(pkg.JavaPkg) {
+		foundPkgs = append(foundPkgs, sbomPkg.Name)
+	}
+
+	// check if both the package in `.metadata.component` and the one in `.components` were found
+	if !reflect.DeepEqual(expectedPkgs, foundPkgs) {
+		t.Errorf("expected packages %v, got %v", expectedPkgs, foundPkgs)
+	}
+}

cmd/syft/internal/test/integration/test-fixtures/image-sbom-metadata-component/Dockerfile

@@ -0,0 +1,2 @@
+FROM scratch
+COPY test.cdx.json /

cmd/syft/internal/test/integration/test-fixtures/image-sbom-metadata-component/test.cdx.json

@@ -0,0 +1,32 @@
+{
+  "bomFormat" : "CycloneDX",
+  "specVersion" : "1.5",
+  "serialNumber" : "urn:uuid:dc807d4b-0415-35ab-ba61-49b5d39bc2d9",
+  "version" : 1,
+  "metadata" : {
+    "component" : {
+      "name" : "main-component",
+      "version" : "1.2.3",
+      "purl" : "pkg:maven/org.example/main-component@1.2.3",
+      "type" : "library",
+      "bom-ref" : "pkg:maven/org.example/main-component@1.2.3"
+    }
+  },
+  "components" : [
+    {
+      "name" : "first-subcomponent",
+      "version" : "2.3.4",
+      "purl" : "pkg:maven/org.example/first-subcomponent@2.3.4",
+      "type" : "library",
+      "bom-ref" : "pkg:maven/org.example/first-subcomponent@2.3.4"
+    }
+  ],
+  "dependencies" : [
+    {
+      "ref" : "pkg:maven/org.example/main-component-assembly@1.2.3",
+      "dependsOn" : [
+        "pkg:maven/org.example/first-subcomponent@2.3.4"
+      ]
+    }
+  ]
+}

syft/format/internal/cyclonedxutil/helpers/decoder.go

@@ -39,11 +39,32 @@
 }
 
 func collectBomPackages(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]interface{}) error {
-	if bom.Components == nil {
+	components := []cyclonedx.Component{}
+	componentsPresent := false
+	if bom.Components != nil {
+		components = *bom.Components
+		componentsPresent = true
+	}
+
+	if bom.Metadata.Component != nil &&
+		(bom.Metadata.Component.Type == cyclonedx.ComponentTypeApplication ||
+			bom.Metadata.Component.Type == cyclonedx.ComponentTypeFramework ||
+			bom.Metadata.Component.Type == cyclonedx.ComponentTypeLibrary ||
+			bom.Metadata.Component.Type == cyclonedx.ComponentTypePlatform) {
+
+		components = append(components, *bom.Metadata.Component)
+		componentsPresent = true
+		if bom.Metadata.Component.Components != nil {
+			components = append(components, *bom.Metadata.Component.Components...)
+		}
+	}
+
+	if !componentsPresent {
 		return fmt.Errorf("no components are defined in the CycloneDX BOM")
 	}
-	for i := range *bom.Components {
-		collectPackages(&(*bom.Components)[i], s, idMap)
+
+	for i := range components {
+		collectPackages(&components[i], s, idMap)
 	}
 	return nil
 }