[FEATURE]: Component Type unknown

[VictorHuu]

Describe the feature

This PR is about the issue.

We should add a component type unknown since with the development of tech ,there are always new types that will emerge, and the SBOM generator like Syft can't handle all of the types currently given that exhaustive implementation for all is almost impossible. The type unknown is used as a fallback for various unrecognized values

Possible solutions

The solution is very simple ,so no need to elaborate on.

Alternatives

None

Additional context

Relative issue about the downstream scenarios:

1. Syft convert from cdx.json -> syft.json -> cdx.json fails anchore/syft#3574

[jkowalleck]

Why? Why "unknown" ? How can there be a component of unknown type?
Whe you know a component exists, you MUST knoe its type, right?

Please provide a real world example.
Thabks in advance.

[VictorHuu]

@jkowalleck Well, a SBOM related software should know the type of a component eventually, but maybe not present.Now, I think its the duty of implementation not specification. Sorry for my thoughtless PR.

[nscuro]

@jkowalleck I imagine this is a common issue for folks converting between formats. Presumably the alternative to unknown would be to pick one of the available types, but then type could no longer be treated as an assertion. evidence.identity doesn't support type, so confidence cannot be communicated.

Practically speaking, is there any "safe" way for @VictorHuu to achieve their goal without risking populating the BOM with plain wrong data? Since type is required, leaving it empty is not an option.

[jkowalleck]

We should add a component type unknown

sorry, i still don't see a description of a problem.
Instead, i see a proposal for a "solution", without any background. I will convert this ticket to a discussion, so that a proper requirements engineering might happen.