feat: Record where CPEs come from (#2552)

Browse Source

Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

...

This commit is contained in:

William Murphy

2024-02-02 16:17:52 +00:00

committed by GitHub

parent 4fe50f4169

commit b7a6d5e946

47 changed files with 2674 additions and 287 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

schema/json/schema-16.0.0.json

+2164

File diff suppressed because it is too large Load Diff