⭐️ support cnquery sbom with shell (#5782)

Author: chris-rock

providers/sbom.go

@@ -95,6 +95,7 @@ func (s *sbomProviderService) Connect(req *plugin.ConnectReq, callback plugin.Pr
 		sbom.NewCycloneDX(sbom.FormatCycloneDxXML),
 		sbom.NewSPDX(sbom.FormatSpdxTagValue),
 		sbom.NewSPDX(sbom.FormatSpdxJSON),
+		sbom.New(sbom.FormatJson),
 	)
 
 	var sbomReport *sbom.Sbom

sbom/cnquery_bom.go

@@ -5,6 +5,7 @@ package sbom
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 )
 
@@ -54,5 +55,10 @@ func (ccx *CnqueryBOM) Parse(r io.Reader) (*Sbom, error) {
 		return nil, err
 	}
 
+	// Test if the SBOM has a valid structure
+	if s.Asset == nil {
+		return nil, fmt.Errorf("unable to parse cnquery SBOM: missing asset information")
+	}
+
 	return &s, nil
 }

sbom/spdx.go

@@ -168,13 +168,13 @@ func (s *Spdx) Parse(r io.Reader) (*Sbom, error) {
 	// try to parse all supported SPDX format
 	if s.Format == FormatSpdxTagValue {
 		doc, err := tagvalue.Read(r)
-		if err == nil {
+		if err == nil && doc.SPDXVersion != "" {
 			return s.convertToSbom(doc), nil
 		}
 	} else if s.Format == FormatSpdxJSON {
 		var doc spdx.Document
 		err := json.NewDecoder(r).Decode(&doc)
-		if err == nil {
+		if err == nil && doc.SPDXVersion != "" {
 			return s.convertToSbom(&doc), nil
 		}
 	}