oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-01 06:56:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: run root file catalogers after the archive task with owned-by-package selection

Browse Source 
with nested cataloging on, java leaves root-level archives to the archive task, so a root `app.jar` package only exists once that task has run. With the default `FilesOwnedByPackageSelection` the root file catalogers ran in an earlier group, never saw the package, and `app.jar` got no file metadata or digests. It did get them with the feature off.

- in owned-by-package mode the groups are now packages, then the archive task, then the root file tasks. Other modes are unchanged
- the file tasks merge their results into the SBOM instead of replacing the maps, since the archive task has already written nested files into them

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman
2026-09-24 13:34:09 -04:00
parent 9d820c6d94
commit 23de18918e
3 changed files with 39 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/task/file_tasks.go
+4 -4
View File
@@ -48,7 +48,7 @@ func newFileDigestCatalogerTask(selection file.Selection, hashers []crypto.Hash,
result, err := filedigest.NewCataloger(hashers).Catalog(ctx, resolver, coordinates...)
accessor.WriteToSBOM(func(sbom *sbom.SBOM) {
sbom.Artifacts.FileDigests = result
mergeInto(&sbom.Artifacts.FileDigests, result)
})
return err
@@ -79,7 +79,7 @@ func newFileMetadataCatalogerTask(selection file.Selection, tags ...string) Task
result, err := filemetadata.NewCataloger().Catalog(ctx, resolver, coordinates...)
accessor.WriteToSBOM(func(sbom *sbom.SBOM) {
sbom.Artifacts.FileMetadata = result
mergeInto(&sbom.Artifacts.FileMetadata, result)
})
return err
@@ -105,7 +105,7 @@ func newFileContentCatalogerTask(cfg filecontent.Config, tags ...string) Task {
result, err := filecontent.NewCataloger(cfg).Catalog(ctx, resolver)
accessor.WriteToSBOM(func(sbom *sbom.SBOM) {
sbom.Artifacts.FileContents = result
mergeInto(&sbom.Artifacts.FileContents, result)
})
return err
@@ -131,7 +131,7 @@ func newExecutableCatalogerTask(selection file.Selection, cfg executable.Config,
result, err := executable.NewCataloger(cfg).CatalogCtx(ctx, resolver)
accessor.WriteToSBOM(func(sbom *sbom.SBOM) {
sbom.Artifacts.Executables = result
mergeInto(&sbom.Artifacts.Executables, result)
})
return err