oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2025-11-20 18:03:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

chore: drop cpe from gguf (#4383)

Browse Source 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
This commit is contained in:
Christopher Angelo Phillips 2025-11-19 05:37:40 -05:00 committed by GitHub
parent 759909f611
commit 9aca8167b8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 37 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
syft/pkg/cataloger/internal/cpegenerate/generate.go
View File

@ -62,16 +62,13 @@ func GetIndexedDictionary() (_ *dictionary.Indexed, err error) {
func FromDictionaryFind(p pkg.Package) ([]cpe.CPE, bool) {
dict, err := GetIndexedDictionary()
parsedCPEs := []cpe.CPE{}
if err != nil {
log.Debugf("CPE dictionary lookup not available: %+v", err)
return parsedCPEs, false
return []cpe.CPE{}, false
}
var (
cpes *dictionary.Set
ok bool
)
var cpes *dictionary.Set
var ok bool
switch p.Type {
case pkg.NpmPkg:
@ -101,20 +98,25 @@ func FromDictionaryFind(p pkg.Package) ([]cpe.CPE, bool) {
case pkg.WordpressPluginPkg:
metadata, valid := p.Metadata.(pkg.WordpressPluginEntry)
if !valid {
return parsedCPEs, false
return nil, false
}
cpes, ok = dict.EcosystemPackages[dictionary.EcosystemWordpressPlugins][metadata.PluginInstallDirectory]
case pkg.ModelPkg:
// ML models should not have CPEs as they are not traditional software packages
// and don't fit the vulnerability model used for software packages.
return nil, false
default:
// The dictionary doesn't support this package type yet.
return parsedCPEs, false
return nil, false
}
if !ok {
// The dictionary doesn't have a CPE for this package.
return parsedCPEs, false
return []cpe.CPE{}, false
}
parsedCPEs := []cpe.CPE{}
for _, c := range cpes.List() {
parsedCPE, err := cpe.New(c, cpe.NVDDictionaryLookupSource)
if err != nil {
@ -126,7 +128,7 @@ func FromDictionaryFind(p pkg.Package) ([]cpe.CPE, bool) {
}
if len(parsedCPEs) == 0 {
return []cpe.CPE{}, false
return nil, false
}
sort.Sort(cpe.BySourceThenSpecificity(parsedCPEs))
@ -137,6 +139,12 @@ func FromDictionaryFind(p pkg.Package) ([]cpe.CPE, bool) {
// generate the minimal set of representative CPEs, which implies that optional fields should not be included
// (such as target SW).
func FromPackageAttributes(p pkg.Package) []cpe.CPE {
// ML models should not have CPEs as they are not traditional software packages
// and don't fit the vulnerability model used for software packages.
if p.Type == pkg.ModelPkg {
return nil
}
vendors := candidateVendors(p)
products := candidateProducts(p)
targetSWs := candidateTargetSw(p)

19
syft/pkg/cataloger/internal/cpegenerate/generate_test.go
View File

@ -846,6 +846,15 @@ func TestGeneratePackageCPEs(t *testing.T) {
"cpe:2.3:a:something_else:something_else_.net:2.5.1:*:*:*:*:*:*:*",
},
},
{
name: "ML model package should generate no CPEs",
p: pkg.Package{
Name: "llama3-8b",
Version: "3.0",
Type: pkg.ModelPkg,
},
expected: []string{},
},
}
for _, test := range tests {
@ -1136,6 +1145,16 @@ func TestDictionaryFindIsWired(t *testing.T) {
// without the cpe data wired up, this would be empty (generation also creates cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*)
wantExists: true,
},
{
name: "ML model packages should not have dictionary CPEs",
pkg: pkg.Package{
Name: "llama3-8b",
Version: "3.0",
Type: pkg.ModelPkg,
},
want: []cpe.CPE{},
wantExists: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {