[BUG] CycloneDX ingestion segfault

[lumjjb]

More details:

#169 (comment) (opened by @electricgull)

[lumjjb]

FYI: @nadgowdas

[nadgowdas]

This is an interesting case. For SBOMs we are expecting expecting the identify root component (which is typically an image) and is captured in an SBOM (atleast the ones that are produced by syft).
The SBOM in this case, seem to have been generated from package.json (@electricgull can you share how this SBOM was generated ?) and does not capture root component in the metadata.

Current SBOM: https://github.com/JupiterOne/graph-github/blob/guac-bom-test-cg/reports/bom.json#L6-L11
Syft Image SBOM: https://github.com/guacsec/guac/blob/main/internal/testing/processor/testdata/alpine-cyclonedx.json#L6-L20

We need to support all these SBOMs variations. In this case, the question is what should be the root component ?

We can add SBOM file with its sha as the root element. Thought ? @lumjjb @pxp928

[electricgull]

We are using this docker container created from here:
https://github.com/JupiterOne/node-cdx-bom

https://github.com/JupiterOne/node-cdx-bom/blob/main/Dockerfile
https://github.com/JupiterOne/node-cdx-bom/blob/main/bin/node-cdx-bom

[lumjjb]

I think for us to create the edges, we would need the top level component. I think in this case, a missing top level "component" would probably mean that we would only create nodes for each individual component but not link it to any top level component so it doesn't exists...

@stevespringett do you have any recommendations for CDX here?