oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-03 16:06:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: improve CPE and upstream generation logic for Alpine packages (#1567)

Browse Source 
* fix: improved CPE-generation logic for alpine packages

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: improved alpine upstream name generation

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: improve CPE vendor for alpine

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: python vendor CPE gen

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: alpine cpe gen logic

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: apk CPE update for nodejs-current

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: CPE update for python pip

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix: CPE update for some ruby packages

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

* fix linting

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

---------

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
This commit is contained in:
Weston Steimel
2023-02-13 17:23:13 +00:00
committed by GitHub
parent 890fb3f0e8
commit 57a13ae355
8 changed files with 419 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/apkdb/package.go
+19 -1
View File
@@ -9,6 +9,10 @@ import (
"github.com/anchore/syft/syft/source"
)
var (
prefixes = []string{"py-", "py2-", "py3-", "ruby-"}
)
func newPackage(d pkg.ApkMetadata, release *linux.Release, locations ...source.Location) pkg.Package {
p := pkg.Package{
Name: d.Package,
@@ -26,6 +30,20 @@ func newPackage(d pkg.ApkMetadata, release *linux.Release, locations ...source.L
return p
}
func generateUpstream(m pkg.ApkMetadata) string {
if m.OriginPackage != "" && m.OriginPackage != m.Package {
return m.OriginPackage
}
for _, p := range prefixes {
if strings.HasPrefix(m.Package, p) {
return strings.TrimPrefix(m.Package, p)
}
}
return m.Package
}
// packageURL returns the PURL for the specific Alpine package (see https://github.com/package-url/purl-spec)
func packageURL(m pkg.ApkMetadata, distro *linux.Release) string {
if distro == nil || distro.ID != "alpine" {
@@ -38,7 +56,7 @@ func packageURL(m pkg.ApkMetadata, distro *linux.Release) string {
}
if m.OriginPackage != "" {
qualifiers[pkg.PURLQualifierUpstream] = m.OriginPackage
qualifiers[pkg.PURLQualifierUpstream] = generateUpstream(m)
}
return packageurl.NewPackageURL(
syft/pkg/cataloger/apkdb/package_test.go
+28
View File
@@ -96,6 +96,34 @@ func Test_PackageURL(t *testing.T) {
},
expected: "pkg:apk/alpine/p@v?arch=a&upstream=origin&distro=alpine-3.4.6",
},
{
name: "upstream python package information as qualifier",
metadata: pkg.ApkMetadata{
Package: "py3-potatoes",
Version: "v",
Architecture: "a",
OriginPackage: "py3-potatoes",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/py3-potatoes@v?arch=a&upstream=potatoes&distro=alpine-3.4.6",
},
{
name: "python package with origin package as upstream",
metadata: pkg.ApkMetadata{
Package: "py3-non-existant",
Version: "v",
Architecture: "a",
OriginPackage: "abcdefg",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/py3-non-existant@v?arch=a&upstream=abcdefg&distro=alpine-3.4.6",
},
}
for _, test := range tests {