oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 15:36:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: read CycloneDX BOM components from metadata (#3092)

Browse Source 
Signed-off-by: dervoeti <lukas.voetmand@stackable.tech>
This commit is contained in:
Lukas Voetmand
2024-08-12 16:37:23 -04:00
committed by GitHub
parent df1e5b57fe
commit 3161e1847e
4 changed files with 74 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/format/internal/cyclonedxutil/helpers/decoder.go
+15 -4
View File
@@ -39,12 +39,23 @@ func ToSyftModel(bom *cyclonedx.BOM) (*sbom.SBOM, error) {
}
func collectBomPackages(bom *cyclonedx.BOM, s *sbom.SBOM, idMap map[string]interface{}) error {
if bom.Components == nil {
componentsPresent := false
if bom.Components != nil {
for i := range *bom.Components {
collectPackages(&(*bom.Components)[i], s, idMap)
}
componentsPresent = true
}
if bom.Metadata != nil && bom.Metadata.Component != nil {
collectPackages(bom.Metadata.Component, s, idMap)
componentsPresent = true
}
if !componentsPresent {
return fmt.Errorf("no components are defined in the CycloneDX BOM")
}
for i := range *bom.Components {
collectPackages(&(*bom.Components)[i], s, idMap)
}
return nil
}