fix(sbom): read the tool from a CycloneDX services entry

A hosted generator records itself under metadata.tools.services rather than
under components, so the tool came back empty for any document using that
slot. The SBOM our own pipeline produces is one: it names Snyk there and
nowhere else. Measured on that document, tools went from nil to
["SBOM Export API v1.131.1"], with 1023 packages unchanged.

The schema vendored with cyclonedx-go defines metadata.tools as the tools
used in the creation, enrichment and validation of the BOM, and its services
slot as "a list of services used as tools". CycloneDX's own 1.6 example
fills components and services together, so a signing service that signed a
document is now listed as a tool. Two existing expectations were updated.

Each slot contributes a name and a version and no vendor. Not a new rule:
the deprecated slot carries a Vendor field and this reader has always
ignored it.

An entry that identifies nothing is skipped. Document.Tools has two writers,
at sbom.go:273 and sbom.go:441, and each used to record a blank. Measured
against the unguarded code:

    CycloneDX component name "  ", version "1.0"
        -> "   1.0"
    CycloneDX xml name and version wrapped across lines
        -> "\n                        Awesome Tool\n                     \n                        9.1.2\n                    "
    SPDX creator "Tool:"
        -> ""

The shared rule is what blank means, not the append. An SPDX creator is one
free-text field with no separable version, so routing it through the
CycloneDX helper would assert that syft-1.50.0 has no version. Each writer
applies the same predicate to whichever field identifies a tool in its
format. A block whose entries are all skipped yields nil, not an empty list.

Fixtures, and where each came from:
  cyclonedx-tools-services.json       cut from the SBOM the pipeline produced
                                      on 2026-09-14: its header, metadata and
                                      first component
  cyclonedx-tools-nameless-service.json  that file, with two services entries
                                      added, one named "" and one named "   "
  cyclonedx-wrapped-tool-name.xml     the repo's CycloneDX 1.6 XML fixture with
                                      the tool name and version wrapped across
                                      lines, as a pretty-printer emits them
  spdx-blank-tool-creator.json        the repo's SPDX 2.3 fixture, creators list
  spdx-only-blank-tool-creator.json   changed and nothing else; edited as text,
                                      because a JSON round trip re-encoded a
                                      non-ASCII character in a licence body

search: grep -n '\.Tools\s*=' internal/sbom/sbom.go -> two writers, both now
        reaching blank(). An earlier search for the helper name found only
        what already routed through it, which is why the second was missed.
mutation: guards mutated one at a time. Weakening the CycloneDX check from
        blank(name) to name == "", dropping the SPDX blank check, or dropping
        either trim, each turns a named case red. Trimming the SPDX creator
        turned nothing red, because both spdx readers trim before this code
        sees the value, so it was removed rather than shipped untested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: AlexKantor87

internal/sbom/sbom.go

@@ -324,29 +324,58 @@ func packageCount(components *[]cdx.Component) int {
 	return count
 }
 
-// toolsFromCycloneDX reads both tool layouts. Spec 1.5 moved tools from a
-// dedicated list to components, and the library keeps the older list populated
-// for documents that use it, so a document may fill either. The services slot
-// the same spec added is deliberately skipped: a service a document consumed is
-// not a tool that generated it.
+// toolsFromCycloneDX reads every tool slot. Spec 1.5 replaced the dedicated list
+// with components and services, and the library keeps the older list populated for
+// documents that use it, so a document fills either the deprecated list or the
+// components and services pair, never both.
+//
+// A hosted generator such as Snyk's export API records itself only under services.
+// Each slot contributes a name and a version; none contributes a vendor, including
+// the deprecated one that carries a Vendor field.
 func toolsFromCycloneDX(tools *cdx.ToolsChoice) []string {
 	if tools == nil {
 		return nil
 	}
 	var names []string
 	if tools.Tools != nil {
 		for _, tool := range *tools.Tools {
-			names = append(names, nameAndVersion(tool.Name, tool.Version))
+			names = appendTool(names, tool.Name, tool.Version)
 		}
 	}
 	if tools.Components != nil {
 		for _, component := range *tools.Components {
-			names = append(names, nameAndVersion(component.Name, component.Version))
+			names = appendTool(names, component.Name, component.Version)
+		}
+	}
+	if tools.Services != nil {
+		for _, service := range *tools.Services {
+			names = appendTool(names, service.Name, service.Version)
 		}
 	}
 	return names
 }
 
+// blank reports a string that would identify nothing once recorded. Both writers of
+// Document.Tools apply it, each to the field that identifies a tool in its own format:
+// a CycloneDX entry's name, an SPDX creator string. Sharing the rule rather than the
+// append keeps the two honest without pretending an SPDX creator has a separate version.
+func blank(s string) bool {
+	return strings.TrimSpace(s) == ""
+}
+
+// appendTool records one CycloneDX tool, skipping an entry whose name is blank. No slot
+// contributes a vendor, so such an entry would reach the attestation as a bare version
+// or an empty string. Name and version are recorded trimmed: encoding/xml keeps the
+// surrounding newlines when a document wraps them across lines. A block whose entries
+// are all skipped yields nil rather than an empty list, which is how "none recorded" is
+// distinguished from "recorded as empty".
+func appendTool(names []string, name, version string) []string {
+	if blank(name) {
+		return names
+	}
+	return append(names, nameAndVersion(strings.TrimSpace(name), strings.TrimSpace(version)))
+}
+
 func nameAndVersion(name, version string) string {
 	if version == "" {
 		return name
@@ -404,7 +433,11 @@ func documentFromSPDX(doc *spdx.Document) (*Document, error) {
 		}
 		out.CreatedAt = created
 		for _, creator := range doc.CreationInfo.Creators {
-			if creator.CreatorType == "Tool" {
+			// A creator of "Tool:" decodes to an empty creator, so the same blank rule
+			// the CycloneDX reader applies has to hold on this side of the same field.
+			// No trim here: both spdx readers trim the creator before this sees it, so
+			// one would be a guard no test could turn red.
+			if creator.CreatorType == "Tool" && !blank(creator.Creator) {
 				out.Tools = append(out.Tools, creator.Creator)
 			}
 		}

internal/sbom/sbom_test.go

@@ -82,19 +82,32 @@ func TestPackageCountExcludesFiles(t *testing.T) {
 	assert.Equal(t, 2, got.Document.PackageCount)
 }
 
-func TestToolsReadFromBothCycloneDXLayouts(t *testing.T) {
+func TestToolsReadFromEveryCycloneDXLayout(t *testing.T) {
 	for _, tc := range []struct {
 		name string
 		file string
+		want []string
 	}{
-		{"post-1.5 components layout", "cyclonedx-tools.json"},
-		{"deprecated pre-1.5 layout", "cyclonedx-tools-deprecated.json"},
+		// The spec's own 1.6 example fills components and services together. The schema
+		// defines metadata.tools as the tools used in the creation, enrichment and
+		// validation of the BOM, and services as "a list of services used as tools".
+		{"components and services together", "cyclonedx-tools.json", []string{"Awesome Tool 9.1.2", "Acme Signing Server"}},
+		{"deprecated pre-1.5 layout", "cyclonedx-tools-deprecated.json", []string{"Awesome Tool 9.1.2"}},
+		// Cut from the SBOM our own pipeline produced on 2026-09-14.
+		{"1.5 services layout", "cyclonedx-tools-services.json", []string{"SBOM Export API v1.131.1"}},
+		// A nameless entry would reach the attestation as " v1.131.1", which names
+		// nothing.
+		{"entries named nothing or only whitespace are skipped", "cyclonedx-tools-nameless-service.json", []string{"SBOM Export API v1.131.1"}},
+		// A pretty-printer wraps character data across lines and encoding/xml keeps the
+		// newlines and indentation, so a name that is only whitespace, or padded, arrives
+		// that way. This is the shape a real document produces; "  " is contrived.
+		{"a wrapped xml name and version are trimmed", "cyclonedx-wrapped-tool-name.xml", []string{"Awesome Tool 9.1.2", "Acme Signing Server"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			got, err := ProcessSBOMFile(fixture(tc.file))
 
 			require.NoError(t, err)
-			assert.Equal(t, []string{"Awesome Tool 9.1.2"}, got.Document.Tools)
+			assert.Equal(t, tc.want, got.Document.Tools)
 		})
 	}
 }
@@ -267,6 +280,29 @@ func TestPackageCountExcludesTheSubject(t *testing.T) {
 	assert.Equal(t, 2, got.Document.PackageCount)
 }
 
+func TestSPDXToolCreatorsAreHeldToTheSameBlankRule(t *testing.T) {
+	// Document.Tools has two writers. A creator string of "Tool:" decodes to an empty
+	// creator, so without the rule on this side the attestation records a tool that
+	// names nothing.
+	t.Run("a blank creator is skipped and a named one is kept", func(t *testing.T) {
+		got, err := ProcessSBOMFile(fixture("spdx-blank-tool-creator.json"))
+
+		require.NoError(t, err)
+		assert.Equal(t, []string{"real-tool-1.0"}, got.Document.Tools)
+	})
+
+	t.Run("when every tool creator is blank the field is null, not empty", func(t *testing.T) {
+		got, err := ProcessSBOMFile(fixture("spdx-only-blank-tool-creator.json"))
+
+		require.NoError(t, err)
+		assert.Nil(t, got.Document.Tools)
+
+		encoded, err := json.Marshal(got.Document)
+		require.NoError(t, err)
+		assert.Contains(t, string(encoded), `"tools":null`)
+	})
+}
+
 func TestToolsAreNullWhenTheSBOMRecordsNone(t *testing.T) {
 	// The fixture carries a tools block holding nothing, so the tool-reading path
 	// runs and still yields null: the server's schema types tools as nullable,
@@ -423,7 +459,7 @@ func TestTheXMLReaderPopulatesTheSameFields(t *testing.T) {
 	got, err := ProcessSBOMFile(fixture("cyclonedx-1.6.xml"))
 
 	require.NoError(t, err)
-	assert.Equal(t, []string{"Awesome Tool 9.1.2"}, got.Document.Tools)
+	assert.Equal(t, []string{"Awesome Tool 9.1.2", "Acme Signing Server"}, got.Document.Tools)
 	require.NotNil(t, got.Document.CreatedAt)
 	assert.Equal(t, "2020-04-07T07:01:00Z", *got.Document.CreatedAt)
 	assert.Equal(t, 3, got.Document.PackageCount)

internal/sbom/testdata/cyclonedx-tools-nameless-service.json

@@ -0,0 +1,49 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2026-09-14T11:33:15Z",
+    "tools": {
+      "services": [
+        {
+          "provider": {
+            "name": "Snyk"
+          },
+          "name": "",
+          "version": "v1.131.1"
+        },
+        {
+          "provider": {
+            "name": "Snyk"
+          },
+          "name": "   ",
+          "version": "v1.131.1"
+        },
+        {
+          "provider": {
+            "name": "Snyk"
+          },
+          "name": "SBOM Export API",
+          "version": "v1.131.1"
+        }
+      ]
+    },
+    "component": {
+      "bom-ref": "1-772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely@9239aba",
+      "type": "container",
+      "name": "772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely",
+      "version": "9239aba"
+    }
+  },
+  "components": [
+    {
+      "bom-ref": "1-docker-image|772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely@9239aba",
+      "type": "library",
+      "group": "alpine",
+      "name": "docker-image|772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely",
+      "version": "9239aba",
+      "purl": "pkg:apk/alpine/merkely@9239aba?distro=alpine-3.24.1&upstream=docker-image%7C772819027869.dkr.ecr.eu-central-1.amazonaws.com"
+    }
+  ]
+}

internal/sbom/testdata/cyclonedx-tools-services.json

@@ -0,0 +1,35 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2026-09-14T11:33:15Z",
+    "tools": {
+      "services": [
+        {
+          "provider": {
+            "name": "Snyk"
+          },
+          "name": "SBOM Export API",
+          "version": "v1.131.1"
+        }
+      ]
+    },
+    "component": {
+      "bom-ref": "1-772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely@9239aba",
+      "type": "container",
+      "name": "772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely",
+      "version": "9239aba"
+    }
+  },
+  "components": [
+    {
+      "bom-ref": "1-docker-image|772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely@9239aba",
+      "type": "library",
+      "group": "alpine",
+      "name": "docker-image|772819027869.dkr.ecr.eu-central-1.amazonaws.com/merkely",
+      "version": "9239aba",
+      "purl": "pkg:apk/alpine/merkely@9239aba?distro=alpine-3.24.1&upstream=docker-image%7C772819027869.dkr.ecr.eu-central-1.amazonaws.com"
+    }
+  ]
+}