oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-31 06:26:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix Bitnami CPE application part (#5127)

Browse Source 
Signed-off-by: vigneshakaviki <kumarvignesh295@gmail.com>
This commit is contained in:
Vignesh
2026-10-26 15:33:13 +00:00
committed by GitHub
parent 1401107138
commit 842d2b3deb
2 changed files with 29 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/bitnami/cataloger.go
+12
View File
@@ -10,6 +10,7 @@ import (
"github.com/anchore/syft/internal/log"
"github.com/anchore/syft/syft/artifact"
"github.com/anchore/syft/syft/cpe"
"github.com/anchore/syft/syft/file"
"github.com/anchore/syft/syft/format"
"github.com/anchore/syft/syft/pkg"
@@ -57,6 +58,7 @@ func parseSBOM(_ context.Context, resolver file.Resolver, _ *generic.Environment
p.FoundBy = catalogerName
p.Type = pkg.BitnamiPkg
setApplicationPart(p.CPEs)
// replace all locations on the package with the location of the SBOM file.
// Why not keep the original list of locations? Since the "locations" field is meant to capture
// where there is evidence of this file, and the catalogers have not run against any file other than,
@@ -178,3 +180,13 @@ func findMainPkgID(relationships []artifact.Relationship) artifact.ID {
return ""
}
// setApplicationPart marks CPEs with an unspecified part as applications, since Bitnami SBOMs
// describe application packages but leave the CPE part as a wildcard.
func setApplicationPart(cpes []cpe.CPE) {
for i := range cpes {
if cpes[i].Attributes.Part == cpe.Any {
cpes[i].Attributes.Part = "a"
}
}
}
syft/pkg/cataloger/bitnami/cataloger_test.go
+17 -17
View File
@@ -37,7 +37,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/postgresql@17.2.0-8?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:postgresql:postgresql:17.2.0:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "postgresql",
@@ -64,7 +64,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/geos@3.13.0?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:libgeos:geos:3.13.0:*:*:*:*:*:*:*",
"cpe:2.3:a:libgeos:geos:3.13.0:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "geos",
@@ -86,7 +86,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/proj@6.3.2?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:proj:proj:6.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:proj:proj:6.3.2:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "proj",
@@ -108,7 +108,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/gdal@3.10.1?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:osgeo:gdal:3.10.1:*:*:*:*:*:*:*",
"cpe:2.3:a:osgeo:gdal:3.10.1:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "gdal",
@@ -130,7 +130,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/json-c@0.16.20220414?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*",
"cpe:2.3:a:json-c_project:json-c:0.16.20220414:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "json-c",
@@ -152,7 +152,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/orafce@4.14.1?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:orafce:orafce:4.14.1:*:*:*:*:*:*:*",
"cpe:2.3:a:orafce:orafce:4.14.1:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "orafce",
@@ -174,7 +174,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/pljava@1.6.8?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*",
"cpe:2.3:a:pl/java_project:pl/java:1.6.8:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "pljava",
@@ -201,7 +201,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/unixodbc@2.3.12?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*",
"cpe:2.3:a:unixodbc:unixodbc:2.3.12:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "unixodbc",
@@ -223,7 +223,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/psqlodbc@16.0.0?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:postgresql:psqlodbc:16.0.0:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "psqlodbc",
@@ -245,7 +245,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/protobuf@3.21.12?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:golang:protobuf:3.21.12:*:*:*:*:*:*:*",
"cpe:2.3:a:golang:protobuf:3.21.12:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "protobuf",
@@ -267,7 +267,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/protobuf-c@1.5.1?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:protobuf-c:protobuf-c:1.5.1:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "protobuf-c",
@@ -289,7 +289,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/postgis@3.4.4?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:postgis:postgis:3.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:postgis:postgis:3.4.4:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "postgis",
@@ -330,7 +330,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/pgbackrest@2.54.2?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*",
"cpe:2.3:a:pgbackrest:pgbackrest:2.54.2:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "pgbackrest",
@@ -352,7 +352,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/wal2json@2.6.0?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:wal2json:wal2json:2.6.0:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "wal2json",
@@ -374,7 +374,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/nss_wrapper@1.1.16?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*",
"cpe:2.3:a:nss_wrapper:nss_wrapper:1.1.16:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "nss_wrapper",
@@ -410,7 +410,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/render-template@1.0.7-4?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:render-template:render-template:1.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:render-template:render-template:1.0.7:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "render-template",
@@ -435,7 +435,7 @@ func TestBitnamiCataloger(t *testing.T) {
FoundBy: catalogerName,
PURL: "pkg:bitnami/redis@7.4.0-0?arch=arm64&distro=debian-12",
CPEs: mustCPEs(
"cpe:2.3:*:redis:redis:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redis:redis:7.4.0:*:*:*:*:*:*:*",
),
Metadata: &pkg.BitnamiSBOMEntry{
Name: "redis",