[SPEC] Deprecated syntax for "`author`" field: not following CycloneDX v1.6 Spec in syft 1.9

What happened

The deprecated syntax for the "author" field is still used by syft v1.9.0, resulting in the following warning/error deprecation message:

syft-Screenshot_20240715_110037

Expected "`authors`" field

You can see an example of a valid authors field of CycloneDX v1.6 here: https://github.com/CycloneDX/specification/blob/62a669075f1897193a14060e0784e6a7576b693d/tools/src/test/resources/1.6/valid-bom-1.6.json#L26

You can check cyclonedx 1.6: https://cyclonedx.org/docs/1.6/json/#components_items_author

The BOM file generated by Syft should look like this:

{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1c4d1c8b-3f2a-41bd-b03f-c8e150fc23e1",
  "version": 1,
  "metadata": {
    "timestamp": "2024-07-15T08:43:56Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "authors": [
            {
              "name": "anchore"
            }
          ],
          "name": "syft",
          "version": "1.9.0"
        }
      ]
    },
  }
[...]
}

In github.com/CycloneDX/cyclonedx-go, there is a deprecation notice for the author field // Deprecated: Use authors or manufacturer instead..

The authors field is implemented like this: https://github.com/CycloneDX/cyclonedx-go/blob/795ee183544e3f8376b984e911f00188f79e90d8/cyclonedx.go#L230

type Component struct {
[...]
    Manufacturer       *OrganizationalEntity    `json:"manufacturer,omitempty" xml:"manufacturer,omitempty"`
    Author             string                   `json:"author,omitempty" xml:"author,omitempty"` // Deprecated: Use authors or manufacturer instead.
    Authors            *[]OrganizationalContact `json:"authors,omitempty" xml:"authors>author,omitempty"`
[...]
}

[...]
type OrganizationalContact struct {
    BOMRef string `json:"bom-ref,omitempty" xml:"bom-ref,attr,omitempty"`
    Name   string `json:"name,omitempty" xml:"name,omitempty"`
    Email  string `json:"email,omitempty" xml:"email,omitempty"`
    Phone  string `json:"phone,omitempty" xml:"phone,omitempty"`
}
[...]

Steps to reproduce the issue

In our case, syft is triggered by a tool called goreleaser on a GoLang project on a Gitlab.

# .goreleaser.yaml file
  - id: syft-CycloneDX-sbom-binary
    cmd: syft
    artifacts: binary
    documents:
      - "${artifact}.syft.cyclonedx.sbom.json"
    args: ["$artifact", "--output", "cyclonedx-json","--file","$document"]

This syft from goreleaser command corresponds to:

syft <artifact_name> --output "cyclonedx-json" --file <output_filename>

Environment

Output of syft version:

syft version

Application: syft
Version:    1.9.0
BuildDate:  2024-07-11T17:32:46Z
GitCommit:  4e09908ba124dca7e6f1f6e7dc4f4663fae658ca
GitDescription: v1.9.0
Platform:   linux/amd64
GoVersion:  go1.22.5
Compiler:   gc

OS (e.g: cat /etc/os-release or similar):

cat /etc/os-release 

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

cc @louison77

anchore / syft