github.com/anchore/syft@v1.38.2/syft/format/cyclonedxxml/test-fixtures/bad-sbom (about) 1 not an sbom!