fix(materials): best-effort SPDX main component extraction

Address review feedback:
- Return name and version even when PrimaryPackagePurpose is absent
  (kind will be empty string instead of erroring out)
- When OCI image reference parsing fails (e.g. missing registry
  credentials), log at debug level and continue with the original
  name instead of returning an error

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com>

Author: waveywaves

pkg/attestation/crafter/materials/spdxjson.go

@@ -122,21 +122,20 @@ func (i *SPDXJSONCrafter) extractMainComponent(m *api.Attestation_Material, doc
 	name := describedPkg.PackageName
 	version := describedPkg.PackageVersion
 
-	// PrimaryPackagePurpose is optional in SPDX 2.3. If absent, skip main component extraction
-	// since we cannot determine the component kind.
+	// PrimaryPackagePurpose is optional in SPDX 2.3. Best effort: return name
+	// and version even if kind is unknown.
 	kind := strings.ToLower(describedPkg.PrimaryPackagePurpose)
-	if kind == "" {
-		return fmt.Errorf("described package %q has no PrimaryPackagePurpose set", describedPkg.PackageName)
-	}
 
 	// For container packages, standardize the name via go-containerregistry
-	// to get the full repository name and strip any tag (matching CycloneDX behavior)
+	// to get the full repository name and strip any tag (matching CycloneDX behavior).
+	// If parsing fails (e.g. missing registry credentials), continue with the original name.
 	if kind == containerComponentKind {
 		ref, err := remotename.ParseReference(name)
 		if err != nil {
-			return fmt.Errorf("couldn't parse OCI image repository name: %w", err)
+			i.logger.Debug().Err(err).Str("name", name).Msg("couldn't parse OCI image reference, using original name")
+		} else {
+			name = ref.Context().String()
 		}
-		name = ref.Context().String()
 	}
 
 	m.M.(*api.Attestation_Material_SbomArtifact).SbomArtifact.MainComponent = &api.Attestation_Material_SBOMArtifact_MainComponent{

pkg/attestation/crafter/materials/spdxjson_test.go

@@ -165,11 +165,13 @@ func TestSPDXJSONCraft(t *testing.T) {
 			},
 		},
 		{
-			name:                "described package without PrimaryPackagePurpose (optional in SPDX 2.3)",
-			filePath:            "./testdata/sbom-spdx-no-purpose.json",
-			wantDigest:          "sha256:140b55bcbdd447fee1c86d50d8459b05159bebcd80a8a8da4ea6475eeab2f487",
-			wantFilename:        "sbom-spdx-no-purpose.json",
-			wantNoMainComponent: true,
+			name:                     "described package without PrimaryPackagePurpose returns best-effort name and version",
+			filePath:                 "./testdata/sbom-spdx-no-purpose.json",
+			wantDigest:               "sha256:140b55bcbdd447fee1c86d50d8459b05159bebcd80a8a8da4ea6475eeab2f487",
+			wantFilename:             "sbom-spdx-no-purpose.json",
+			wantMainComponent:        "my-lib",
+			wantMainComponentKind:    "",
+			wantMainComponentVersion: "2.0.0",
 			annotations: map[string]string{
 				"chainloop.material.tool.name":    "syft",
 				"chainloop.material.tool.version": "0.100.0",