Skip to content

bug(cyclonedx): Error while SBOM's parsing of file MetadataComponent #9416

Description

@DmitriyLewen

Description

Trivy doesn't support file type of the MetadataComponent:

$ trivy sbom --debug --scanners vuln C:\Users\IvoŠmíd\AppData\Roaming\JetBrains\GoLand2025.2\scratches\scratch_11.json
...
2025-08-22T14:56:54+02:00	FATAL	Fatal error
  - run error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        C:/dev/git/trivy/pkg/commands/artifact/run.go:412
  - sbom scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.run
        C:/dev/git/trivy/pkg/commands/artifact/run.go:450
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        C:/dev/git/trivy/pkg/commands/artifact/run.go:289
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        C:/dev/git/trivy/pkg/commands/artifact/run.go:679
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact
        C:/dev/git/trivy/pkg/scan/service.go:166
  - SBOM decode error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/sbom.Artifact.Inspect
        C:/dev/git/trivy/pkg/fanal/artifact/sbom/sbom.go:59
  - failed to decode:
    github.com/aquasecurity/trivy/pkg/sbom.Decode
        C:/dev/git/trivy/pkg/sbom/sbom.go:227
  - failed to parse sbom:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*BOM).UnmarshalJSON
        C:/dev/git/trivy/pkg/sbom/cyclonedx/unmarshal.go:55
  - failed to parse root component:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*BOM).parseBOM
        C:/dev/git/trivy/pkg/sbom/cyclonedx/unmarshal.go:72
  - failed to parse metadata component:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*BOM).parseMetadataComponent
        C:/dev/git/trivy/pkg/sbom/cyclonedx/unmarshal.go:105
  - failed to unmarshal component type:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*BOM).parseComponent
        C:/dev/git/trivy/pkg/sbom/cyclonedx/unmarshal.go:167
  - unsupported type

Discussed in #9373

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions