oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-02-12 10:36:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: read CycloneDX BOM components from metadata (#3092)

Browse Source 
Signed-off-by: dervoeti <lukas.voetmand@stackable.tech>
This commit is contained in:
Lukas Voetmand 2024-08-12 22:37:23 +02:00 committed by GitHub
parent df1e5b57fe
commit 3161e1847e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 74 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
cmd/syft/internal/test/integration/sbom_metadata_component_test.go Normal file
View File

@ -0,0 +1,25 @@
package integration
import (
"reflect"
"testing"
"github.com/anchore/syft/syft/pkg"
"github.com/anchore/syft/syft/source"
)
func TestSbomMetadataComponent(t *testing.T) {
sbom, _ := catalogFixtureImage(t, "image-sbom-metadata-component", source.SquashedScope, "+sbom-cataloger")
expectedPkgs := []string{"first-subcomponent", "main-component"}
foundPkgs := []string{}
for sbomPkg := range sbom.Artifacts.Packages.Enumerate(pkg.JavaPkg) {
foundPkgs = append(foundPkgs, sbomPkg.Name)
}
// check if both the package in `.metadata.component` and the one in `.components` were found
if !reflect.DeepEqual(expectedPkgs, foundPkgs) {
t.Errorf("expected packages %v, got %v", expectedPkgs, foundPkgs)
}
}

2
cmd/syft/internal/test/integration/test-fixtures/image-sbom-metadata-component/Dockerfile Normal file
View File

@ -0,0 +1,2 @@
FROM scratch
COPY test.cdx.json /

32
cmd/syft/internal/test/integration/test-fixtures/image-sbom-metadata-component/test.cdx.json Normal file
View File

@ -0,0 +1,32 @@
{
"bomFormat" : "CycloneDX",
"specVersion" : "1.5",
"serialNumber" : "urn:uuid:dc807d4b-0415-35ab-ba61-49b5d39bc2d9",
"version" : 1,
"metadata" : {
"component" : {
"name" : "main-component",
"version" : "1.2.3",
"purl" : "pkg:maven/org.example/main-component@1.2.3",
"type" : "library",
"bom-ref" : "pkg:maven/org.example/main-component@1.2.3"
}
},
"components" : [
{
"name" : "first-subcomponent",
"version" : "2.3.4",
"purl" : "pkg:maven/org.example/first-subcomponent@2.3.4",
"type" : "library",
"bom-ref" : "pkg:maven/org.example/first-subcomponent@2.3.4"
}
],
"dependencies" : [
{
"ref" : "pkg:maven/org.example/main-component-assembly@1.2.3",
"dependsOn" : [
"pkg:maven/org.example/first-subcomponent@2.3.4"
]
}
]
}

19
syft/format/internal/cyclonedxutil/helpers/decoder.go
View File

@ -39,12 +39,23 @@ func ToSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
}
func collectBomPackages(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]interface{}) error {
if bom.Components == nil {
componentsPresent := false
if bom.Components != nil {
for i := range *bom.Components {
collectPackages(&(*bom.Components)[i], s, idMap)
}
componentsPresent = true
}
if bom.Metadata != nil && bom.Metadata.Component != nil {
collectPackages(bom.Metadata.Component, s, idMap)
componentsPresent = true
}
if !componentsPresent {
return fmt.Errorf("no components are defined in the CycloneDX BOM")
}
for i := range *bom.Components {
collectPackages(&(*bom.Components)[i], s, idMap)
}
return nil
}