oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-02-12 02:26:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Validating download_url for github repositories, and updating if necessary (#4390)

Browse Source 
* Adding a second function to validate/correct urls that are just github repositories

Signed-off-by: Kendrick <kmartinix@gmail.com>

* Adding test case to capture github repositories

Signed-off-by: Kendrick <kmartinix@gmail.com>

---------

Signed-off-by: Kendrick <kmartinix@gmail.com>
This commit is contained in:
Kendrick 2025-12-10 10:41:00 -08:00 committed by GitHub
parent 47e1cee5a5
commit 7fdb08c0b6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
syft/format/internal/spdxutil/helpers/download_location.go
View File

@ -1,6 +1,7 @@
package helpers
import (
"net/url"
"strings"
urilib "github.com/spdx/gordf/uri"
@ -49,9 +50,21 @@ func isURIValid(uri string) bool {
func URIValue(uri string) string {
if strings.ToLower(uri) != "none" {
if isURIValid(uri) {
return uri
return updateForGithub(url.Parse(uri))
}
return NOASSERTION
}
return NONE
}
// Github repository is a valid NPM location but not a valid SPDX DownloadURL
func updateForGithub(uri *url.URL, err error) string {
if err != nil {
return NOASSERTION
}
updatedLocation := uri.String()
if uri.Scheme == "github" {
updatedLocation = "https://github.com/" + uri.Opaque
}
return updatedLocation
}

10
syft/format/internal/spdxutil/helpers/download_location_test.go
View File

@ -640,6 +640,16 @@ func Test_DownloadLocation(t *testing.T) {
},
expected: "bzr+https://bzr.myproject.org/MyProject/trunk@2019#src/somefile.c",
},
{
name: "Github Repository",
input: pkg.Package{
Metadata: pkg.NpmPackage{
URL: "github:anchore/syft",
},
},
expected: "https://github.com/anchore/syft",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {