github.com/google/osv-scalibr@v0.4.1/extractor/filesystem/sbom/cdx/testdata/invalid_sbom.cdxjson (about) 1 Not an sbom at all!