oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-31 14:36:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: Record where CPEs come from (#2552)

Browse Source 
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
This commit is contained in:
William Murphy
2024-02-02 16:17:52 +00:00
committed by GitHub
parent 4fe50f4169
commit b7a6d5e946
47 changed files with 2674 additions and 287 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/java/graalvm_native_image_cataloger.go
+2 -2
View File
@@ -117,9 +117,9 @@ func (c *nativeImageCataloger) Name() string {
func getPackage(component nativeImageComponent) pkg.Package {
var cpes []cpe.CPE
for _, property := range component.Properties {
c, err := cpe.New(property.Value)
c, err := cpe.New(property.Value, cpe.DeclaredSource)
if err != nil {
log.Debugf("unable to parse CPE: %v", err)
log.Debugf("unable to parse Attributes: %v", err)
continue
}
cpes = append(cpes, c)
syft/pkg/cataloger/java/graalvm_native_image_cataloger_test.go
+21 -12
View File
@@ -80,22 +80,31 @@ func TestParseNativeImageSbom(t *testing.T) {
},
CPEs: []cpe.CPE{
{
Part: "a",
Vendor: "codec",
Product: "codec",
Version: "4.1.73.Final",
Attributes: cpe.Attributes{
Part: "a",
Vendor: "codec",
Product: "codec",
Version: "4.1.73.Final",
},
Source: "declared",
},
{
Part: "a",
Vendor: "codec",
Product: "netty-codec-http2",
Version: "4.1.73.Final",
Attributes: cpe.Attributes{
Part: "a",
Vendor: "codec",
Product: "netty-codec-http2",
Version: "4.1.73.Final",
},
Source: "declared",
},
{
Part: "a",
Vendor: "codec",
Product: "netty_codec_http2",
Version: "4.1.73.Final",
Attributes: cpe.Attributes{
Part: "a",
Vendor: "codec",
Product: "netty_codec_http2",
Version: "4.1.73.Final",
},
Source: "declared",
},
},
},