oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-05 00:46:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: 1944 - update purl generation to use a consistent groupID (#2033)

Browse Source 
Separate the logic for CPE and PURL generation. 

PURL generation needs a single answer for groupID based on a priority of discovering the field. 
CPE generation still uses multiple potential groupID to populate the candidate cpe.

Improve GroupID detection. 

Currently syft does not use any hierarchy for GroupID detection and treats all sources as equal. 
It treats fields from the manifest file with priority. This change adds a hierarchy to the fields and returns a single answer based on that hierarchy.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
This commit is contained in:
Christopher Angelo Phillips
2023-08-22 10:47:07 -04:00
committed by GitHub
co-authored by Keith Zantow
parent cf37b17869
commit ee121cff21
7 changed files with 247 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/java/parse_pom_xml.go
+3 -1
View File
@@ -178,7 +178,9 @@ func resolveProperty(pom gopom.Project, property *string) string {
pomValueType = pomValue.Type()
if pomValueType.Kind() == reflect.Ptr {
pomValue = pomValue.Elem()
pomValueType = pomValue.Type()
if !pomValue.IsZero() {
pomValueType = pomValue.Type()
}
}
if partNum == numParts-1 {
return fmt.Sprintf("%v", pomValue.Interface())