oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-04 00:16:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use package ID from decoded SBOMs when provided (#1872)

Browse Source 
* fix: use package id from cyclonedx when provided

Signed-off-by: James Neate <jamesmneate@gmail.com>

* override package IDs from converted SBOMs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix typo

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove extractSyftID function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: James Neate <jamesmneate@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
James Neate
2025-05-08 11:25:30 -04:00
committed by GitHub
co-authored by Alex Goodman
parent 39396cfff9
commit 00c4a4e72a
17 changed files with 238 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/format/common/spdxhelpers/to_syft_model_test.go
+31 -2
View File
@@ -664,7 +664,7 @@ func Test_directPackageFiles(t *testing.T) {
Packages: []*spdx.Package{
{
PackageName: "some-package",
PackageSPDXIdentifier: "1",
PackageSPDXIdentifier: "1", // important!
PackageVersion: "1.0.5",
Files: []*spdx.File{
{
@@ -689,7 +689,7 @@ func Test_directPackageFiles(t *testing.T) {
Name: "some-package",
Version: "1.0.5",
}
p.SetID()
p.OverrideID("1") // the same as the spdxID on the package element
f := file.Location{
LocationData: file.LocationData{
Coordinates: file.Coordinates{
@@ -730,3 +730,32 @@ func Test_directPackageFiles(t *testing.T) {
require.Equal(t, s, got)
}
func Test_useSPDXIdentifierOverDerivedSyftArtifactID(t *testing.T) {
doc := &spdx.Document{
SPDXVersion: "SPDX-2.3",
Packages: []*spdx.Package{
{
PackageName: "some-package",
PackageSPDXIdentifier: "1", // important!
PackageVersion: "1.0.5",
Files: []*spdx.File{
{
FileName: "some-file",
FileSPDXIdentifier: "2",
Checksums: []spdx.Checksum{
{
Algorithm: "SHA1",
Value: "a8d733c64f9123",
},
},
},
},
},
},
}
s, err := ToSyftModel(doc)
assert.Nil(t, err)
assert.NotNil(t, s.Artifacts.Packages.Package("1"))
}