Dependency graph of BOMs generated with Syft is incomplete due to missing root node

What happened: After uploading SBOMs in Dependency Track (v4.11.5), created by syft, we encountered the problem that the dependency graphs could not be displayed.

We tested it with the latest alpine version:

This results in the following SBOM sbom_diy.json

The logs do not include anything noticeable:

What you expected to happen: A complete (displayable) Dependency Graph

Steps to reproduce the issue:

1. Create SBOM - run: docker pull alpine:latest

• name: Generate SBOM run: | ${{ runner.temp }}/syft/syft alpine:latest -o cyclonedx-json=sbom_diy.json
  env: PATH: ${{ runner.temp }}/syft:$PATH

1. Upload SBOM to DT using

• name: Upload SBOM to Dependency Track using curl run: | curl -X "POST" "DTINSTANCELINK/api/v1/bom" -H "Content-Type: multipart/form-data" -H "X-Api-Key: working API KEY" -F "autoCreate=true" -F "projectName=DIY_test_image_alpine" -F "projectVersion=1" -F "bom=@sbom_diy.json"

Anything else we need to know?: We already created an issue for Dependency Track. It was determined that it is not a problem in DT, but in the SBOM itself, as it has a missing root.

Environment:

• Output of syft version: v1.9.0
• OS (e.g: cat /etc/os-release or similar): -