Golang sbom - Return Http Status= 500, NullPointer Exception logged

[zvigrinberg]

Description:

Golang sbom sent to Exhort API - Return Http Status= 500 without response budy, NullPointer Exception logged in exhort logs

Investigation:

It appears that when the sbom contains packages without group/namespaces, then it happens.

for example:

{
    "name": "go.opencensus.io",
    "version": "v0.23.0",
    "purl": "pkg:golang/go.opencensus.io@v0.23.0",
    "type": "library",
    "bom-ref": "pkg:golang/go.opencensus.io@v0.23.0"
}

it looks like it expects the namespace to be populated in such case.

I Checked also the origin of this package in go mod graph , and this is what i saw: