Invalid purl/bom-ref field when contains '?' or ':' chars?

[bruegth]

When purl/bom-ref field contains a '?' char like this:

{
    "bomFormat": "CycloneDX",
    "specVersion": "1.4",
    "serialNumber": "urn:uuid:151b045d-ef9c-47e8-9943-7b325834a13b",
    "version": 1,
    "metadata": {
        "timestamp": "2022-05-25T11:38:14.899573013Z",
        "tools": [
            {
                "vendor": "aquasecurity",
                "name": "trivy",
                "version": "0.25.2"
            }
        ],
        "component": {
            "bom-ref": "pkg:oci/isp_aggregationdatahandler@sha256:4a5986dc98d7d899fa2fce87626862aed7bec168b44f83ffca2c5d179f917823?repository_url=...

then dependency graph not working. Maybe this can be an Issue in Trivy output otherwise? see here https://aquasecurity.github.io/trivy/v0.28.0/docs/sbom/cyclonedx/

[stevespringett]

Do you have a bom from trivy that you can attach to the ticket?

[bruegth]

Do you have a bom from trivy that you can attach to the ticket?

Test-sbom.zip

[bruegth]

Duplicate of #85