Summary

Grype currently produces CYCLONE-DX SBOM that are not compliant with the cyclone-dx tooling libraries. Rather than write the logic in two places, this PR moves grype to use syft's formatting functions as a library to produce valid CYCLONE-DX SBOM components along with the discovered vulnerabilities.

For more context on why this is an issue see:
Fixes #796
Fixes #951

Testing note: image-simple was unused under the cyclone-dx test-fixures so was removed in favor of the snapshot presenter testing.

Breaking Changes

• Grype no longer makes a distinction between cyclonedx-schema and the cyclonedx-vex-schema. See here for schema definitions that only make a distinction between the json and xml schema.
• Given the above, format options for grype have been simplified. Grype now does cyclonedx and cyclonedx-xml. The options for embedded-cyclonedx-vex-json and embedded-cyclonedx-vex-xml have been removed.
• Grype no longer outputs CYCLONE-DX 1.2. Vulnerabilities are no longer nested under components as a consequence of this change.
• Updated schema definitions have been added to schema/cyclonedx/. These have been sourced from the above schema link

Comparison chart:

OLD									New
embedded-cyclonedx-vex-json ---> 	cyclonedx
embedded-cyclonedx-vex-xml--->		cyclonedx-xml

Format changes
cyclonedx				  ----> 	now outputs 1.4 json ---- was 1.2 XML

To consider

Take a look at the two following outputs. The version of grype is 0.54.0

grype -o embedded-cyclonedx-vex-json alpine:latest > vuln_old.json 

This command uses this branch:

go run main.go -o cyclonedx alpine:latest > vuln.json

The above commands should both output cyclonedx-1.4-json documents:

Note: in the above example we're seeing binary cataloger overlaps with package cataloger matching so that's probably a PR we want in separately before the next release so we can match on the correct package.

Notice how alpine shows 1.35.0-r29 vs binary cataloger which is showing 1.35.0, the latter of which is vulnerable.

Highlights from the above output comparrisons

• Metadata component now has a bomref
• component data contains expanded set of fields including but not limited to publisher, description, properties, and references
• Vulnerabilities now come with a bom ref field
• Vulnerabilities now come with a reference field
• Empty analysis and properties fields have been dropped

Signed-off-by: Christopher Phillips [email protected]