fix: file selection within archives, spdx / cyclonedx file representation

Signed-off-by: Keith Zantow <kzantow@gmail.com>
This commit is contained in:
Keith Zantow
2026-10-27 14:52:18 -04:00
parent 6d34eba977
commit 851dc327c5
27 changed files with 865 additions and 340 deletions
@@ -344,7 +344,10 @@ func Test_toSyftRelationships(t *testing.T) {
}
pkg3.SetID()
loc1 := file.NewLocationFromCoordinates(file.NewCoordinates("/somewhere/real", "abc"))
loc1 := file.NewLocationFromCoordinates(file.Coordinates{
RealPath: "/somewhere/real",
FileSystemID: "abc",
})
tests := []struct {
name string
@@ -691,8 +694,11 @@ func Test_directPackageFiles(t *testing.T) {
p.OverrideID("1") // the same as the spdxID on the package element
f := file.Location{
LocationData: file.LocationData{
Coordinates: file.NewCoordinates("some-file", ""),
AccessPath: "some-file",
Coordinates: file.Coordinates{
RealPath: "some-file",
FileSystemID: "",
},
AccessPath: "some-file",
},
LocationMetadata: file.LocationMetadata{
Annotations: map[string]string{},
@@ -789,12 +795,3 @@ func Test_skipsPackagesWithGeneratedFromRelationship(t *testing.T) {
assert.NotNil(t, s.Artifacts.Packages.Package("1"))
assert.Nil(t, s.Artifacts.Packages.Package("1-src"))
}
func Test_coordinatesFromFile_nonCanonicalChainIsDropped(t *testing.T) {
// a chain the name doesn't end with leaves FullPath equal to RealPath, which must decode as a plain file
got := coordinatesFromFile("/app.jar", "archivePath: other.jar!/x", "")
assert.Equal(t, file.NewCoordinates("/app.jar", ""), got)
nested := coordinatesFromFile("/app.war!/lib/a.jar", "archivePath: lib/a.jar", "")
assert.Equal(t, file.Coordinates{RealPath: "/app.war", FullPath: "/app.war!/lib/a.jar"}, nested)
}