oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-02-12 10:36:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: deterministic java purls (#2170)

Browse Source 
Previously, which PURL was generated depended on the order of key iteration
in maps. Also update an integ test that was apparently only passing because
of the previous issue.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
This commit is contained in:
William Murphy 2023-09-25 09:28:18 -04:00 committed by GitHub
parent 8314c0d2cb
commit e34adea749
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
syft/pkg/cataloger/common/cpe/java.go
View File

@ -1,6 +1,7 @@
package cpe package cpe
import ( import (
"sort"
"strings" "strings"
"github.com/scylladb/go-set/strset" "github.com/scylladb/go-set/strset"
@ -287,6 +288,7 @@ func GetManifestFieldGroupIDs(manifest *pkg.JavaManifest, fields []string) (grou
} }
} }
} }
sort.Strings(groupIDs)
return groupIDs return groupIDs
} }

1
syft/pkg/cataloger/common/cpe/java_groupid_map.go
View File

@ -37,6 +37,7 @@ var DefaultArtifactIDToGroupID = map[string]string{
"ant-weblogic": "org.apache.ant", "ant-weblogic": "org.apache.ant",
"ant-xz": "org.apache.ant", "ant-xz": "org.apache.ant",
"commons-codec": "commons-codec", "commons-codec": "commons-codec",
"commons-logging": "commons-logging", // see e.g. https://mvnrepository.com/artifact/commons-logging/commons-logging/1.1.1
"okhttp": "com.squareup.okhttp3", "okhttp": "com.squareup.okhttp3",
"okio": "com.squareup.okio", "okio": "com.squareup.okio",
"spring": "org.springframework", "spring": "org.springframework",

6
test/integration/java_purl_test.go
View File

@ -76,9 +76,9 @@ var expectedPURLs = map[string]string{
"commons-jexl@1.1-hudson-20090508": "pkg:maven/org.jvnet.hudson/commons-jexl@1.1-hudson-20090508", "commons-jexl@1.1-hudson-20090508": "pkg:maven/org.jvnet.hudson/commons-jexl@1.1-hudson-20090508",
"commons-lang@2.4": "pkg:maven/commons-lang/commons-lang@2.4", "commons-lang@2.4": "pkg:maven/commons-lang/commons-lang@2.4",
"commons-lang@2.5": "pkg:maven/commons-lang/commons-lang@2.5", "commons-lang@2.5": "pkg:maven/commons-lang/commons-lang@2.5",
"commons-logging@1.0.4": "pkg:maven/org.apache.commons.logging/commons-logging@1.0.4", "commons-logging@1.0.4": "pkg:maven/commons-logging/commons-logging@1.0.4", // see https://mvnrepository.com/artifact/commons-logging/commons-logging/1.0.4
"commons-logging@1.1": "pkg:maven/org.apache.commons.logging/commons-logging@1.1", "commons-logging@1.1": "pkg:maven/commons-logging/commons-logging@1.1", // see https://mvnrepository.com/artifact/commons-logging/commons-logging/1.1
"commons-logging@1.1.1": "pkg:maven/commons-logging/commons-logging@1.1.1", "commons-logging@1.1.1": "pkg:maven/commons-logging/commons-logging@1.1.1", // see https://mvnrepository.com/artifact/commons-logging/commons-logging/1.1.1
"commons-pool@1.3": "pkg:maven/commons-pool/commons-pool@1.3", "commons-pool@1.3": "pkg:maven/commons-pool/commons-pool@1.3",
"crypto-util@1.0": "pkg:maven/org.jvnet.hudson/crypto-util@1.0", "crypto-util@1.0": "pkg:maven/org.jvnet.hudson/crypto-util@1.0",
"cvs@1.2": "pkg:maven/org.jvnet.hudson.plugins/cvs@1.2", "cvs@1.2": "pkg:maven/org.jvnet.hudson.plugins/cvs@1.2",