Invalid SPDX SBOM

[vargenau]

In the download section, you provide an SBOM, which is good.

It is named e.g.: sbomasm-darwin-amd64.spdx.sbom

It would be better to name it sbomasm-darwin-amd64.spdx.json to conform the SPDX naming conventions.

Also, it is slightly invalid SPDX:

pyspdxtools -i sbomasm-darwin-amd64.spdx.json
ERROR:root:The document is invalid. The following issues have been found:
file name must not be an absolute path starting with "/", but is: /sbomasm-darwin-amd64

[vargenau]

Since you are using syft-1.11.1 this is bug anchore/syft#2093

Perhaps you can postprocess before publishing.

[riteshnoronha]

@vargenau good point, yea we are actually moving all our sbom generation to sbom-tool. Will update this in the next release.