oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-04 08:26:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

Longer CPEs for golang modules to avoid false positives (#1006)

Browse Source 
* golang module CPE with full path

Signed-off-by: Jonas Xavier <jonasx@anchore.com>

* add note on longer Golang CPEs

Signed-off-by: Jonas Xavier <jonasx@anchore.com>
This commit is contained in:
Jonas Xavier
2022-05-23 10:39:34 -07:00
committed by GitHub
parent d41afe05eb
commit c990f425a6
3 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/common/cpe/go.go
+3 -1
View File
@@ -28,7 +28,9 @@ func candidateProductForGo(name string) string {
return ""
}
return pathElements[1]
// returning the rest of the path here means longer CPEs, it helps avoiding false-positives
// ref: https://github.com/anchore/grype/issues/676
return strings.Join(pathElements[1:], "/")
}
// candidateVendorForGo attempts to find a single vendor name in a best-effort attempt. This implementation prefers