Panic when scanning simple SPDX sbom created by syft

[dfandrich]

Description

trivy panics when scanning a simple SPDX SBOM created by syft .

Desired Behavior

trivy should run to completion without error, which it does when the reproduction steps are changed to scan an even simpler SBOM from the busybox Docker container instead of alpine.

Actual Behavior

See the log under reproduction steps.

Reproduction Steps

$ syft --version
syft 1.19.0
$ syft scan --output spdx-tag-value=alpine3212.spdx docker:alpine:3.21.2
 ✔ Pulled image
 ✔ Loaded image                                                                      alpine:3.21.2
 ✔ Parsed image                    sha256:b0c9d60fc5e3fa2319a86ccc1cdf34c94c7e69766e8cebfb4111f7e5
 ✔ Cataloged contents              63a967612a571cb651a5584f825e8b60532290b41ea111e7dc7360e0f192ce2
   ├── ✔ Packages                        [15 packages]
   ├── ✔ File digests                    [82 files]
   ├── ✔ File metadata                   [82 locations]
   └── ✔ Executables                     [17 executables]
$ docker run --rm aquasec/trivy -v
Version: 0.59.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-02-07 00:23:10.882109023 +0000 UTC
  NextUpdate: 2025-02-08 00:23:10.882108883 +0000 UTC
  DownloadedAt: 2025-02-07 05:28:45.141204147 +0000 UTC
$ docker run --rm -v $PWD:/data -v "$HOME/.cache/trivy":/root/.cache/trivy aquasec/trivy sbom /data/alpine3212.spdx
2025-02-07T06:41:36Z    INFO    [vuln] Vulnerability scanning is enabled
2025-02-07T06:41:36Z    INFO    Detected SBOM format    format="spdx-tv"
panic: assignment to entry in nil map

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/sbom/spdx.(*SPDX).parseFiles(0xc000b87cb0, 0xc000fd8000)
        /home/runner/work/trivy/trivy/pkg/sbom/spdx/unmarshal.go:127 +0x13f
github.com/aquasecurity/trivy/pkg/sbom/spdx.(*SPDX).unmarshal(0xc000b87cb0, 0xc000fd8000)
        /home/runner/work/trivy/trivy/pkg/sbom/spdx/unmarshal.go:75 +0x4f
github.com/aquasecurity/trivy/pkg/sbom/spdx.(*TVDecoder).Decode(0x0?, {0x4e54bc0, 0xc000b87cb0})
        /home/runner/work/trivy/trivy/pkg/sbom/spdx/unmarshal.go:45 +0xb6
github.com/aquasecurity/trivy/pkg/sbom.Decode({_, _}, {_, _}, {_, _})
        /home/runner/work/trivy/trivy/pkg/sbom/sbom.go:226 +0x702
github.com/aquasecurity/trivy/pkg/fanal/artifact/sbom.Artifact.Inspect({{0x7ffd0ca2ff6a, 0x15}, {0x7f2f542a2c30, 0xc00121f7c0}, {0x0, {0x0, 0x0, 0x0}, {0x0, 0x0, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/sbom/sbom.go:55 +0x4b7
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0xc000ab53c0, 0x2, 0x2}, {0xc0010d0580, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:156 +0x103
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:627 +0x377
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:259 +0xa5
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanSBOM(_, {_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:236 +0xb4
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x45d964b800, {0xc000969398, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:400 +0x8dd
github.com/aquasecurity/trivy/pkg/commands.NewSBOMCommand.func2(0xc001064008, {0xc000079d60, 0x1, 0x1})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:1184 +0x177
github.com/spf13/cobra.(*Command).execute(0xc001064008, {0xc000079cb0, 0x1, 0x1})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:985 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0xc000ce2308)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1117 +0x3ff
github.com/spf13/cobra.(*Command).Execute(0x5013427?)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1041 +0x13
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:45 +0x113
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x1f

Target

SBOM

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

$ docker run --rm -v $PWD:/data -v "$HOME/.cache/trivy":/root/.cache/trivy aquasec/trivy sbom /data/alpine3212.spdx --debug
2025-02-07T06:53:00Z    DEBUG   No plugins loaded
2025-02-07T06:53:00Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-02-07T06:53:00Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-02-07T06:53:00Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2025-02-07T06:53:00Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-02-07T06:53:00Z    DEBUG   Ignore statuses statuses=[]
2025-02-07T06:53:00Z    DEBUG   DB update was skipped because the local DB is the latest
2025-02-07T06:53:00Z    DEBUG   DB info schema=2 updated_at=2025-02-07T00:23:10.882109023Z next_update=2025-02-08T00:23:10.882108883Z downloaded_at=2025-02-07T05:28:45.141204147Z
2025-02-07T06:53:00Z    DEBUG   [pkg] Package types     types=[os library]
2025-02-07T06:53:00Z    DEBUG   [pkg] Package relationships     relationships=[unknown root workspace direct indirect]
2025-02-07T06:53:00Z    INFO    [vuln] Vulnerability scanning is enabled
2025-02-07T06:53:00Z    DEBUG   Initializing scan cache...      type="memory"
2025-02-07T06:53:00Z    INFO    Detected SBOM format    format="spdx-tv"
panic: assignment to entry in nil map

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/sbom/spdx.(*SPDX).parseFiles(0xc000865200, 0xc000b88640)
        /home/runner/work/trivy/trivy/pkg/sbom/spdx/unmarshal.go:127 +0x13f
github.com/aquasecurity/trivy/pkg/sbom/spdx.(*SPDX).unmarshal(0xc000865200, 0xc000b88640)
        /home/runner/work/trivy/trivy/pkg/sbom/spdx/unmarshal.go:75 +0x4f
github.com/aquasecurity/trivy/pkg/sbom/spdx.(*TVDecoder).Decode(0x0?, {0x4e54bc0, 0xc000865200})
        /home/runner/work/trivy/trivy/pkg/sbom/spdx/unmarshal.go:45 +0xb6
github.com/aquasecurity/trivy/pkg/sbom.Decode({_, _}, {_, _}, {_, _})
        /home/runner/work/trivy/trivy/pkg/sbom/sbom.go:226 +0x702
github.com/aquasecurity/trivy/pkg/fanal/artifact/sbom.Artifact.Inspect({{0x7fff89af0f62, 0x15}, {0x7faf51146010, 0xc000f5a080}, {0x0, {0x0, 0x0, 0x0}, {0x0, 0x0, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/sbom/sbom.go:55 +0x4b7
github.com/aquasecurity/trivy/pkg/scanner.Scanner.ScanArtifact({{_, _}, {_, _}}, {_, _}, {{0xc00118e300, 0x2, 0x2}, {0xc00107c180, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/scanner/scan.go:156 +0x103
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan(_, {_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:627 +0x377
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact(_, {_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:259 +0xa5
github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).ScanSBOM(_, {_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, ...}, ...})
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:236 +0xb4
github.com/aquasecurity/trivy/pkg/commands/artifact.Run({_, _}, {{{0x4fbd530, 0xa}, 0x0, 0x0, 0x1, 0x0, 0x45d964b800, {0xc00075ae88, ...}, ...}, ...}, ...)
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:400 +0x8dd
github.com/aquasecurity/trivy/pkg/commands.NewSBOMCommand.func2(0xc00110a908, {0xc00118e760, 0x1, 0x2})
        /home/runner/work/trivy/trivy/pkg/commands/app.go:1184 +0x177
github.com/spf13/cobra.(*Command).execute(0xc00110a908, {0xc00118e740, 0x2, 0x2})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:985 +0xaaa
github.com/spf13/cobra.(*Command).ExecuteC(0xc000d38c08)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1117 +0x3ff
github.com/spf13/cobra.(*Command).Execute(0x5013427?)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1041 +0x13
main.run()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:45 +0x113
main.main()
        /home/runner/work/trivy/trivy/cmd/trivy/main.go:19 +0x1f

### Operating System

Linux

### Version

```bash
0.59.1

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @dfandrich

Can you share file for testing?

Regards, Dmitriy

[dfandrich]

alpine3212.spdx.gz

[DmitriyLewen]

Thanks!

[DmitriyLewen]

Created #8379 for this task.