refactor(sbom): use multiline json for spdx-json format (#4404)

pkg/report/spdx/spdx.go

@@ -1,9 +1,10 @@
 package spdx
 
 import (
+	"encoding/json"
 	"io"
 
-	"github.com/spdx/tools-golang/json"
+	"github.com/spdx/tools-golang/spdx/v2/v2_3"
 	"github.com/spdx/tools-golang/tagvalue"
 	"golang.org/x/xerrors"
 
@@ -34,7 +35,7 @@ func (w Writer) Write(report types.Report) error {
 	}
 
 	if w.format == "spdx-json" {
-		if err := json.Write(spdxDoc, w.output); err != nil {
+		if err := writeSPDXJson(spdxDoc, w.output); err != nil {
 			return xerrors.Errorf("failed to save spdx json: %w", err)
 		}
 	} else {
@@ -45,3 +46,19 @@ func (w Writer) Write(report types.Report) error {
 
 	return nil
 }
+
+// writeSPDXJson writes in human-readable format(multiple lines)
+// use function from `github.com/spdx/tools-golang` after release https://github.com/spdx/tools-golang/pull/213
+func writeSPDXJson(doc *v2_3.Document, w io.Writer) error {
+	buf, err := json.MarshalIndent(doc, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	_, err = w.Write(buf)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}