fix(spdx): don't panic on a root file without a supplier or null entries (#5326)

The package supplier is optional in SPDX, but fileSource dereferenced it
without the nil check containerSource already has, so a valid SPDX 2.3
document whose described package has primaryPackagePurpose FILE and no
supplier crashed syft convert and grype sbom: input.

A JSON null in files, a package's files or externalRefs (or an SPDX 2.1
package the version converter cannot map) decodes to a nil pointer that
the conversion then dereferences. Drop nil entries once at the start of
ToSyftModel instead of guarding each loop.

Signed-off-by: Tony <tjagodka@gmail.com>

syft/format/common/spdxhelpers/to_syft_model.go

@@ -34,6 +34,8 @@ func ToSyftModel(doc *spdx.Document) (*sbom.SBOM, error) {
 		return nil, errors.New("cannot convert SPDX document to Syft model because document is nil")
 	}
 
+	removeNilElements(doc)
+
 	spdxIDMap := make(map[string]any)
 
 	s := &sbom.SBOM{
@@ -55,6 +57,28 @@ func ToSyftModel(doc *spdx.Document) (*sbom.SBOM, error) {
 	return s, nil
 }
 
+// removeNilElements drops null entries from the document's lists. A JSON null (or an element the SPDX version
+// converter cannot map) decodes to a nil pointer, and the rest of the conversion dereferences these elements.
+func removeNilElements(doc *spdx.Document) {
+	doc.Packages = withoutNil(doc.Packages)
+	for _, p := range doc.Packages {
+		p.Files = withoutNil(p.Files)
+		p.PackageExternalReferences = withoutNil(p.PackageExternalReferences)
+	}
+	doc.Files = withoutNil(doc.Files)
+	doc.Relationships = withoutNil(doc.Relationships)
+}
+
+func withoutNil[T any](items []*T) []*T {
+	var out []*T
+	for _, item := range items {
+		if item != nil {
+			out = append(out, item)
+		}
+	}
+	return out
+}
+
 func isDirectory(name string) bool {
 	if name == "." || name == ".." || strings.HasSuffix(name, "/") || !strings.Contains(path.Base(name), ".") {
 		return true
@@ -201,7 +225,7 @@ func fileSource(p *spdx.Package) source.Description {
 	}
 
 	supplier := ""
-	if p.PackageSupplier.Supplier != helpers.NOASSERTION {
+	if p.PackageSupplier != nil && p.PackageSupplier.Supplier != helpers.NOASSERTION {
 		supplier = p.PackageSupplier.Supplier
 	}
 

syft/format/spdxjson/decoder_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -183,3 +184,37 @@ func TestDecoder_Identify(t *testing.T) {
 		})
 	}
 }
+
+func TestDecoder_DecodeNullElements(t *testing.T) {
+	// a JSON null in these lists (or an SPDX 2.1 package the version converter cannot map) decodes to a nil pointer.
+	// a null entry directly in "packages" is not covered: for SPDX 2.2 and 2.3 it panics inside spdx/tools-golang
+	for _, doc := range []string{
+		`{"spdxVersion":"SPDX-2.1","packages":[{}]}`,
+		`{"spdxVersion":"SPDX-2.3","files":[null]}`,
+		`{"spdxVersion":"SPDX-2.3","packages":[{"SPDXID":"SPDXRef-a","name":"a","files":[null]}]}`,
+		`{"spdxVersion":"SPDX-2.3","packages":[{"SPDXID":"SPDXRef-a","name":"a","externalRefs":[null]}]}`,
+	} {
+		t.Run(doc, func(t *testing.T) {
+			assert.NotPanics(t, func() {
+				_, _, _, _ = NewFormatDecoder().Decode(strings.NewReader(doc))
+			})
+		})
+	}
+}
+
+func TestDecoder_DecodeFileRootWithoutSupplier(t *testing.T) {
+	// the package supplier is optional in SPDX, including on the package the document describes
+	f, err := os.Open("testdata/spdx/file-root-without-supplier.spdx.json")
+	require.NoError(t, err)
+	defer f.Close()
+
+	s, _, _, err := NewFormatDecoder().Decode(f)
+	require.NoError(t, err)
+	assert.Equal(t, "app.tar.gz", s.Source.Name)
+
+	var names []string
+	for _, p := range s.Artifacts.Packages.Sorted() {
+		names = append(names, p.Name)
+	}
+	assert.Equal(t, []string{"requests"}, names)
+}

syft/format/spdxjson/testdata/spdx/file-root-without-supplier.spdx.json

@@ -0,0 +1,29 @@
+{
+  "spdxVersion": "SPDX-2.3",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "name": "app.tar.gz",
+  "documentNamespace": "https://example.com/spdx/app-1.0",
+  "creationInfo": { "created": "2026-09-24T00:00:00Z", "creators": ["Tool: example-1.0"] },
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-app",
+      "name": "app.tar.gz",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "primaryPackagePurpose": "FILE"
+    },
+    {
+      "SPDXID": "SPDXRef-requests",
+      "name": "requests",
+      "versionInfo": "2.31.0",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "externalRefs": [{ "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", "referenceLocator": "pkg:pypi/requests@2.31.0" }]
+    }
+  ],
+  "relationships": [
+    { "spdxElementId": "SPDXRef-DOCUMENT", "relationshipType": "DESCRIBES", "relatedSpdxElement": "SPDXRef-app" },
+    { "spdxElementId": "SPDXRef-app", "relationshipType": "CONTAINS", "relatedSpdxElement": "SPDXRef-requests" }
+  ]
+}