Incorrect Package Ecosystem in SPDX SBOM Scanning

[abhisek]

SPDX SBOM scanning, such as, what is used while scanning Github Dependency Insight API output (SPDX SBOM data) results in incorrect package ecosystem detection. In this case, a Manifest type is considered to be SPDX but Package ecosystem type should be based on detected ecosystem and should not be same as Manifest's ecosystem (SPDX)

Example:

vet scan --github https://github.com/safedep/vet --report-json /tmp/vet.json

cat /tmp/vet.json| jq '.packages[5]'
{
  "package": {
    "ecosystem": "SpdxSBOM",
    "name": "postcss-minify-params",
    "version": "5.1.4"
  },
  "manifests": [
    "55b2cc8afd01bd61"
  ]
}