chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.7.2 to 0.8.0 (#2413)

syft/format/common/cyclonedxhelpers/decoder.go

@@ -249,9 +249,22 @@ func extractDescriptor(meta *cyclonedx.Metadata) (desc sbom.Descriptor) {
 		return
 	}
 
-	for _, t := range *meta.Tools {
-		desc.Name = t.Name
-		desc.Version = t.Version
+	// handle 1.5 component element
+	if meta.Tools.Components != nil {
+		for _, t := range *meta.Tools.Components {
+			desc.Name = t.Name
+			desc.Version = t.Version
+			return
+		}
+	}
+
+	// handle pre-1.5 tool element
+	if meta.Tools.Tools != nil {
+		for _, t := range *meta.Tools.Tools {
+			desc.Name = t.Name
+			desc.Version = t.Version
+			return
+		}
 	}
 
 	return

syft/format/common/cyclonedxhelpers/format.go

@@ -114,11 +114,14 @@ func formatCPE(cpeString string) string {
 func toBomDescriptor(name, version string, srcMetadata source.Description) *cyclonedx.Metadata {
 	return &cyclonedx.Metadata{
 		Timestamp: time.Now().Format(time.RFC3339),
-		Tools: &[]cyclonedx.Tool{
-			{
-				Vendor:  "anchore",
-				Name:    name,
-				Version: version,
+		Tools: &cyclonedx.ToolsChoice{
+			Components: &[]cyclonedx.Component{
+				{
+					Type:    cyclonedx.ComponentTypeApplication,
+					Author:  "anchore",
+					Name:    name,
+					Version: version,
+				},
 			},
 		},
 		Properties: toBomProperties(srcMetadata),

syft/format/common/cyclonedxhelpers/format_test.go

@@ -168,13 +168,14 @@ func Test_toBomDescriptor(t *testing.T) {
 			want: &cyclonedx.Metadata{
 				Timestamp:  "",
 				Lifecycles: nil,
-				Tools: &[]cyclonedx.Tool{
-					{
-						Vendor:             "anchore",
-						Name:               "test-image",
-						Version:            "1.0.0",
-						Hashes:             nil,
-						ExternalReferences: nil,
+				Tools: &cyclonedx.ToolsChoice{
+					Components: &[]cyclonedx.Component{
+						{
+							Type:    cyclonedx.ComponentTypeApplication,
+							Author:  "anchore",
+							Name:    "test-image",
+							Version: "1.0.0",
+						},
 					},
 				},
 				Authors: nil,

syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -6,13 +6,16 @@
   "version": 1,
   "metadata": {
     "timestamp": "timestamp:redacted",
-    "tools": [
-      {
-        "vendor": "anchore",
-        "name": "syft",
-        "version": "v0.42.0-bogus"
-      }
-    ],
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "author": "anchore",
+          "name": "syft",
+          "version": "v0.42.0-bogus"
+        }
+      ]
+    },
     "component": {
       "bom-ref":"redacted",
       "type": "file",

syft/format/cyclonedxjson/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -6,13 +6,16 @@
   "version": 1,
   "metadata": {
     "timestamp": "timestamp:redacted",
-    "tools": [
-      {
-        "vendor": "anchore",
-        "name": "syft",
-        "version": "v0.42.0-bogus"
-      }
-    ],
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "author": "anchore",
+          "name": "syft",
+          "version": "v0.42.0-bogus"
+        }
+      ]
+    },
     "component": {
       "bom-ref":"redacted",
       "type": "container",

syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxDirectoryEncoder.golden

@@ -3,11 +3,13 @@
   <metadata>
     <timestamp>redacted</timestamp>
     <tools>
-      <tool>
-        <vendor>anchore</vendor>
-        <name>syft</name>
-        <version>v0.42.0-bogus</version>
-      </tool>
+      <components>
+        <component type="application">
+          <author>anchore</author>
+          <name>syft</name>
+          <version>v0.42.0-bogus</version>
+        </component>
+      </components>
     </tools>
     <component bom-ref="redacted" type="file">
       <name>some/path</name>

syft/format/cyclonedxxml/test-fixtures/snapshot/TestCycloneDxImageEncoder.golden

@@ -3,11 +3,13 @@
   <metadata>
     <timestamp>redacted</timestamp>
     <tools>
-      <tool>
-        <vendor>anchore</vendor>
-        <name>syft</name>
-        <version>v0.42.0-bogus</version>
-      </tool>
+      <components>
+        <component type="application">
+          <author>anchore</author>
+          <name>syft</name>
+          <version>v0.42.0-bogus</version>
+        </component>
+      </components>
     </tools>
     <component bom-ref="redacted" type="container">
       <name>user-image-input</name>