diff --git a/syft/format/common/spdxhelpers/to_format_model.go b/syft/format/common/spdxhelpers/to_format_model.go index 41b193700..3fd6019e0 100644 --- a/syft/format/common/spdxhelpers/to_format_model.go +++ b/syft/format/common/spdxhelpers/to_format_model.go @@ -644,8 +644,11 @@ func toRelationships(relationships []artifact.Relationship) (result []*spdx.Rela continue } - // FIXME: we are only currently including Package -> * relationships - if _, ok := r.From.(pkg.Package); !ok { + // FIXME: we are only currently including Package -> * relationships, plus an archive containing a + // package found inside it, which is the only structure nested archive cataloging records for + // non-java packages. Every file-side From is in the document: toFiles covers every coordinate a + // relationship names. + if _, ok := r.From.(pkg.Package); !ok && !isFileContainsPackage(r) { log.Debugf("skipping non-package relationship: %+v", r) continue } @@ -664,6 +667,12 @@ func toRelationships(relationships []artifact.Relationship) (result []*spdx.Rela return result } +func isFileContainsPackage(r artifact.Relationship) bool { + _, fromFile := r.From.(file.Coordinates) + _, toPkg := r.To.(pkg.Package) + return fromFile && toPkg && r.Type == artifact.ContainsRelationship +} + func lookupRelationship(ty artifact.RelationshipType) (bool, helpers.RelationshipType, string) { switch ty { case artifact.ContainsRelationship: diff --git a/syft/format/common/spdxhelpers/to_format_model_test.go b/syft/format/common/spdxhelpers/to_format_model_test.go index 91325aa26..758995d62 100644 --- a/syft/format/common/spdxhelpers/to_format_model_test.go +++ b/syft/format/common/spdxhelpers/to_format_model_test.go @@ -810,7 +810,7 @@ func Test_fileIDsForPackage(t *testing.T) { expected: nil, }, { - name: "ignore file-to-package", + name: "include an archive file containing a package", relationships: []artifact.Relationship{ { From: c, @@ -818,6 +818,23 @@ func Test_fileIDsForPackage(t *testing.T) { Type: artifact.ContainsRelationship, }, }, + expected: []*spdx.Relationship{ + { + Relationship: "CONTAINS", + RefA: docElementId(c), + RefB: docElementId(p), + }, + }, + }, + { + name: "ignore other file-to-package", + relationships: []artifact.Relationship{ + { + From: c, + To: p, + Type: artifact.DependencyOfRelationship, + }, + }, expected: nil, }, {