mirror of
https://github.com/anchore/syft.git
synced 2026-10-28 21:12:25 +01:00
Compare commits
+3
-3
@@ -26,7 +26,7 @@ tools:
|
||||
# used for linting
|
||||
- name: golangci-lint
|
||||
version:
|
||||
want: v2.3.0
|
||||
want: v2.3.1
|
||||
method: github-release
|
||||
with:
|
||||
repo: golangci/golangci-lint
|
||||
@@ -58,7 +58,7 @@ tools:
|
||||
# used to release all artifacts
|
||||
- name: goreleaser
|
||||
version:
|
||||
want: v2.11.1
|
||||
want: v2.11.2
|
||||
method: github-release
|
||||
with:
|
||||
repo: goreleaser/goreleaser
|
||||
@@ -98,7 +98,7 @@ tools:
|
||||
# used for triggering a release
|
||||
- name: gh
|
||||
version:
|
||||
want: v2.76.1
|
||||
want: v2.76.2
|
||||
method: github-release
|
||||
with:
|
||||
repo: cli/cli
|
||||
|
||||
@@ -37,7 +37,7 @@ runs:
|
||||
- name: Restore tool cache
|
||||
if: inputs.tools == 'true'
|
||||
id: tool-cache
|
||||
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
|
||||
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
|
||||
with:
|
||||
path: ${{ github.workspace }}/.tool
|
||||
key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
|
||||
@@ -63,7 +63,7 @@ runs:
|
||||
|
||||
- name: Restore ORAS cache from github actions
|
||||
if: inputs.download-test-fixture-cache == 'true'
|
||||
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
|
||||
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
|
||||
with:
|
||||
path: ${{ github.workspace }}/.tmp/oras-cache
|
||||
key: ${{ inputs.cache-key-prefix }}-oras-cache
|
||||
|
||||
@@ -36,7 +36,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -47,7 +47,7 @@ jobs:
|
||||
|
||||
# Initializes the CodeQL tools for scanning.
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@4e828ff8d448a8a6e532957b1811f387a63867e8 #v3.29.4
|
||||
uses: github/codeql-action/init@df559355d593797519d70b90fc8edd5db049e7a2 #v3.29.5
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
# If you wish to specify custom queries, you can do so here or in a config file.
|
||||
@@ -58,7 +58,7 @@ jobs:
|
||||
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
|
||||
# If this step fails, then you should remove it and run the build manually (see below)
|
||||
- name: Autobuild
|
||||
uses: github/codeql-action/autobuild@4e828ff8d448a8a6e532957b1811f387a63867e8 #v3.29.4
|
||||
uses: github/codeql-action/autobuild@df559355d593797519d70b90fc8edd5db049e7a2 #v3.29.5
|
||||
|
||||
# ℹ️ Command-line programs to run using the OS shell.
|
||||
# 📚 https://git.io/JvXDl
|
||||
@@ -72,4 +72,4 @@ jobs:
|
||||
# make release
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8 #v3.29.4
|
||||
uses: github/codeql-action/analyze@df559355d593797519d70b90fc8edd5db049e7a2 #v3.29.5
|
||||
|
||||
@@ -34,7 +34,7 @@ jobs:
|
||||
issues: write
|
||||
steps:
|
||||
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
|
||||
@@ -15,7 +15,7 @@ jobs:
|
||||
environment: release
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -116,7 +116,7 @@ jobs:
|
||||
# required for goreleaser signs section with cosign
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
persist-credentials: true
|
||||
@@ -125,13 +125,13 @@ jobs:
|
||||
uses: ./.github/actions/bootstrap
|
||||
|
||||
- name: Login to Docker Hub
|
||||
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
|
||||
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3.5.0
|
||||
with:
|
||||
username: ${{ secrets.ANCHOREOSSWRITE_DH_USERNAME }}
|
||||
password: ${{ secrets.ANCHOREOSSWRITE_DH_PAT }}
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
|
||||
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3.5.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
|
||||
@@ -19,7 +19,7 @@ jobs:
|
||||
permissions:
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
|
||||
@@ -15,7 +15,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository_owner == 'anchore' # only run for main repo (not forks)
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'anchore/syft' # only run for main repo
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
if: github.repository == 'anchore/syft' # only run for main repo
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
|
||||
@@ -23,12 +23,12 @@ jobs:
|
||||
contents: read
|
||||
security-events: write # for uploading SARIF results
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: "Run zizmor"
|
||||
uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
|
||||
uses: zizmorcore/zizmor-action@5ca5fc7a4779c5263a3ffa0e1f693009994446d1 # v0.1.2
|
||||
with:
|
||||
config-file: .github/zizmor.yml
|
||||
sarif-upload: true
|
||||
|
||||
@@ -17,7 +17,7 @@ jobs:
|
||||
name: "Static analysis"
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -34,7 +34,7 @@ jobs:
|
||||
# we need more storage than what's on the default runner
|
||||
runs-on: ubuntu-22.04-4core-16gb
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -52,7 +52,7 @@ jobs:
|
||||
name: "Integration tests"
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -72,7 +72,7 @@ jobs:
|
||||
name: "Build snapshot artifacts"
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -90,7 +90,7 @@ jobs:
|
||||
# why not use actions/upload-artifact? It is very slow (3 minutes to upload ~600MB of data, vs 10 seconds with this approach).
|
||||
# see https://github.com/actions/upload-artifact/issues/199 for more info
|
||||
- name: Upload snapshot artifacts
|
||||
uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
|
||||
uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
|
||||
with:
|
||||
# we need to preserve the snapshot data itself as well as the task data that confirms if the
|
||||
# snapshot build is stale or not. Otherwise the downstream jobs will attempt to rebuild the snapshot
|
||||
@@ -107,7 +107,7 @@ jobs:
|
||||
needs: [Build-Snapshot-Artifacts]
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -118,7 +118,7 @@ jobs:
|
||||
|
||||
- name: Download snapshot build
|
||||
id: snapshot-cache
|
||||
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
|
||||
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
|
||||
with:
|
||||
path: |
|
||||
snapshot
|
||||
@@ -164,7 +164,7 @@ jobs:
|
||||
needs: [Build-Snapshot-Artifacts]
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -175,7 +175,7 @@ jobs:
|
||||
|
||||
- name: Download snapshot build
|
||||
id: snapshot-cache
|
||||
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
|
||||
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
|
||||
with:
|
||||
path: |
|
||||
snapshot
|
||||
@@ -212,7 +212,7 @@ jobs:
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
|
||||
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -225,7 +225,7 @@ jobs:
|
||||
|
||||
- name: Download snapshot build
|
||||
id: snapshot-cache
|
||||
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
|
||||
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
|
||||
with:
|
||||
path: |
|
||||
snapshot
|
||||
@@ -251,7 +251,7 @@ jobs:
|
||||
needs: [Build-Snapshot-Artifacts]
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
@@ -262,7 +262,7 @@ jobs:
|
||||
|
||||
- name: Download snapshot build
|
||||
id: snapshot-cache
|
||||
uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 #v4.2.3
|
||||
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
|
||||
with:
|
||||
path: |
|
||||
snapshot
|
||||
@@ -291,7 +291,7 @@ jobs:
|
||||
- Cli-Linux
|
||||
- Upload-Snapshot-Artifacts
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
|
||||
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
|
||||
+5
-4
@@ -48,12 +48,13 @@ builds:
|
||||
|
||||
archives:
|
||||
- id: linux-archives
|
||||
builds: [linux-build]
|
||||
ids: [linux-build]
|
||||
- id: darwin-archives
|
||||
builds: [darwin-build]
|
||||
ids: [darwin-build]
|
||||
- id: windows-archives
|
||||
format: zip
|
||||
builds: [windows-build]
|
||||
formats:
|
||||
- zip
|
||||
ids: [windows-build]
|
||||
|
||||
nfpms:
|
||||
- license: "Apache 2.0"
|
||||
|
||||
@@ -218,8 +218,9 @@ func getSource(ctx context.Context, opts *options.Catalog, userInput string, sou
|
||||
cfg := syft.DefaultGetSourceConfig().
|
||||
WithRegistryOptions(opts.Registry.ToOptions()).
|
||||
WithAlias(source.Alias{
|
||||
Name: opts.Source.Name,
|
||||
Version: opts.Source.Version,
|
||||
Name: opts.Source.Name,
|
||||
Version: opts.Source.Version,
|
||||
Supplier: opts.Source.Supplier,
|
||||
}).
|
||||
WithExcludeConfig(source.ExcludeConfig{
|
||||
Paths: opts.Exclusions,
|
||||
|
||||
@@ -259,6 +259,9 @@ func (cfg *Catalog) AddFlags(flags clio.FlagSet) {
|
||||
|
||||
flags.StringVarP(&cfg.Source.BasePath, "base-path", "",
|
||||
"base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory")
|
||||
|
||||
flags.StringVarP(&cfg.Source.Supplier, "source-supplier", "",
|
||||
"the organization that supplied the component, which often may be the manufacturer, distributor, or repackager")
|
||||
}
|
||||
|
||||
func (cfg *Catalog) DescribeFields(descriptions fangs.FieldDescriptionSet) {
|
||||
|
||||
@@ -43,9 +43,9 @@ over to the final syft 1.0 json output this option can be used to ease the trans
|
||||
|
||||
Note: long term support for this option is not guaranteed (it may change or break at any time)`)
|
||||
|
||||
descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format.
|
||||
descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format.
|
||||
Note that all template paths are based on the current syft-json schema`)
|
||||
descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating.
|
||||
descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating.
|
||||
if false, uses the syft-json output for templating (which follows the syft JSON schema exactly).
|
||||
|
||||
Note: long term support for this option is not guaranteed (it may change or break at any time)`)
|
||||
|
||||
@@ -16,6 +16,8 @@ import (
|
||||
type sourceConfig struct {
|
||||
Name string `json:"name" yaml:"name" mapstructure:"name"`
|
||||
Version string `json:"version" yaml:"version" mapstructure:"version"`
|
||||
Supplier string `json:"supplier" yaml:"supplier" mapstructure:"supplier"`
|
||||
Source string `json:"source" yaml:"source" mapstructure:"source"`
|
||||
BasePath string `yaml:"base-path" json:"base-path" mapstructure:"base-path"` // specify base path for all file paths
|
||||
File fileSource `json:"file" yaml:"file" mapstructure:"file"`
|
||||
Image imageSource `json:"image" yaml:"image" mapstructure:"image"`
|
||||
|
||||
@@ -78,7 +78,10 @@ func TestEncodeDecodeEncodeCycleComparison(t *testing.T) {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
for _, image := range images {
|
||||
originalSBOM, _ := catalogFixtureImage(t, image, source.SquashedScope)
|
||||
|
||||
// we need a way to inject supplier into this test
|
||||
// supplier is not available as part of the SBOM Config API since the flag
|
||||
// is used in conjunction with the SourceConfig which is injected into generateSBOM during scan
|
||||
originalSBOM.Source.Supplier = "anchore"
|
||||
f := encoders.GetByString(test.name)
|
||||
require.NotNil(t, f)
|
||||
|
||||
|
||||
@@ -89,8 +89,8 @@ require (
|
||||
github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
|
||||
go.uber.org/goleak v1.3.0
|
||||
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
|
||||
golang.org/x/mod v0.26.0
|
||||
golang.org/x/net v0.42.0
|
||||
golang.org/x/mod v0.27.0
|
||||
golang.org/x/net v0.43.0
|
||||
gopkg.in/yaml.v3 v3.0.1
|
||||
modernc.org/sqlite v1.38.2
|
||||
)
|
||||
@@ -268,14 +268,14 @@ require (
|
||||
go.uber.org/atomic v1.9.0 // indirect
|
||||
go.uber.org/multierr v1.9.0 // indirect
|
||||
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
|
||||
golang.org/x/crypto v0.40.0 // indirect
|
||||
golang.org/x/crypto v0.41.0 // indirect
|
||||
golang.org/x/oauth2 v0.30.0 // indirect
|
||||
golang.org/x/sync v0.16.0 // indirect
|
||||
golang.org/x/sys v0.34.0 // indirect
|
||||
golang.org/x/term v0.33.0 // indirect
|
||||
golang.org/x/text v0.27.0 // indirect
|
||||
golang.org/x/sys v0.35.0 // indirect
|
||||
golang.org/x/term v0.34.0 // indirect
|
||||
golang.org/x/text v0.28.0 // indirect
|
||||
golang.org/x/time v0.7.0 // indirect
|
||||
golang.org/x/tools v0.34.0 // indirect
|
||||
golang.org/x/tools v0.35.0 // indirect
|
||||
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
|
||||
google.golang.org/api v0.203.0 // indirect
|
||||
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
|
||||
|
||||
@@ -1643,8 +1643,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
|
||||
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
|
||||
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
|
||||
golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
|
||||
golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
|
||||
golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
|
||||
golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
|
||||
golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
|
||||
golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
|
||||
@@ -1707,8 +1707,8 @@ golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
|
||||
golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
|
||||
golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
|
||||
golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
|
||||
golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
|
||||
golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
|
||||
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
@@ -1777,8 +1777,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
|
||||
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
|
||||
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
|
||||
golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
|
||||
golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
|
||||
golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
|
||||
golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
|
||||
golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
@@ -1936,8 +1936,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
|
||||
golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
|
||||
golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
@@ -1952,8 +1952,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
|
||||
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
|
||||
golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
|
||||
golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
|
||||
golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
|
||||
golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
|
||||
golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
|
||||
golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
|
||||
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
@@ -1974,8 +1974,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
|
||||
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
|
||||
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
|
||||
golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
|
||||
golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
|
||||
golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
|
||||
golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
|
||||
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
@@ -2050,8 +2050,8 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
|
||||
golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
|
||||
golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
|
||||
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
|
||||
golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
|
||||
golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
|
||||
golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0=
|
||||
golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
@@ -3,5 +3,5 @@ package internal
|
||||
const (
|
||||
// JSONSchemaVersion is the current schema version output by the JSON encoder
|
||||
// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
|
||||
JSONSchemaVersion = "16.0.36"
|
||||
JSONSchemaVersion = "16.0.37"
|
||||
)
|
||||
|
||||
@@ -31,6 +31,13 @@ var licenseIDs = map[string]string{
|
||||
{{ printf "%q" $k }}: {{ printf "%q" $v }},
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
// urlToLicense maps license URLs from the seeAlso field to license IDs
|
||||
var urlToLicense = map[string]string{
|
||||
{{- range $url, $id := .URLToLicense }}
|
||||
{{ printf "%q" $url }}: {{ printf "%q" $id }},
|
||||
{{- end }}
|
||||
}
|
||||
`))
|
||||
|
||||
var versionMatch = regexp.MustCompile(`([0-9]+)\.?([0-9]+)?\.?([0-9]+)?\.?`)
|
||||
@@ -68,17 +75,20 @@ func run() error {
|
||||
}()
|
||||
|
||||
licenseIDs := processSPDXLicense(result)
|
||||
urlToLicense := buildURLToLicenseMap(result)
|
||||
|
||||
err = tmp.Execute(f, struct {
|
||||
Timestamp time.Time
|
||||
URL string
|
||||
Version string
|
||||
LicenseIDs map[string]string
|
||||
Timestamp time.Time
|
||||
URL string
|
||||
Version string
|
||||
LicenseIDs map[string]string
|
||||
URLToLicense map[string]string
|
||||
}{
|
||||
Timestamp: time.Now(),
|
||||
URL: url,
|
||||
Version: result.Version,
|
||||
LicenseIDs: licenseIDs,
|
||||
Timestamp: time.Now(),
|
||||
URL: url,
|
||||
Version: result.Version,
|
||||
LicenseIDs: licenseIDs,
|
||||
URLToLicense: urlToLicense,
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
@@ -156,3 +166,30 @@ func cleanLicenseID(id string) string {
|
||||
cleanID := strings.ToLower(id)
|
||||
return strings.ReplaceAll(cleanID, "-", "")
|
||||
}
|
||||
|
||||
// buildURLToLicenseMap creates a mapping from license URLs (from seeAlso fields) to license IDs
|
||||
func buildURLToLicenseMap(result LicenseList) map[string]string {
|
||||
urlMap := make(map[string]string)
|
||||
|
||||
for _, l := range result.Licenses {
|
||||
// Skip deprecated licenses
|
||||
if l.Deprecated {
|
||||
// Find replacement license if available
|
||||
replacement := result.findReplacementLicense(l)
|
||||
if replacement != nil {
|
||||
// Map deprecated license URLs to the replacement license
|
||||
for _, url := range l.SeeAlso {
|
||||
urlMap[url] = replacement.ID
|
||||
}
|
||||
}
|
||||
continue
|
||||
}
|
||||
|
||||
// Add URLs from non-deprecated licenses
|
||||
for _, url := range l.SeeAlso {
|
||||
urlMap[url] = l.ID
|
||||
}
|
||||
}
|
||||
|
||||
return urlMap
|
||||
}
|
||||
|
||||
@@ -35,3 +35,20 @@ func cleanLicenseID(id string) string {
|
||||
id = strings.ToLower(id)
|
||||
return strings.ReplaceAll(id, "-", "")
|
||||
}
|
||||
|
||||
// LicenseInfo contains license ID and name
|
||||
type LicenseInfo struct {
|
||||
ID string
|
||||
}
|
||||
|
||||
// LicenseByURL returns the license ID and name for a given URL from the SPDX license list
|
||||
// The URL should match one of the URLs in the seeAlso field of an SPDX license
|
||||
func LicenseByURL(url string) (LicenseInfo, bool) {
|
||||
url = strings.TrimSpace(url)
|
||||
if id, exists := urlToLicense[url]; exists {
|
||||
return LicenseInfo{
|
||||
ID: id,
|
||||
}, true
|
||||
}
|
||||
return LicenseInfo{}, false
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,97 @@
|
||||
package spdxlicense
|
||||
|
||||
import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestLicenseByURL(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
url string
|
||||
wantID string
|
||||
wantFound bool
|
||||
}{
|
||||
{
|
||||
name: "MIT license URL (https)",
|
||||
url: "https://opensource.org/license/mit/",
|
||||
wantID: "MIT",
|
||||
wantFound: true,
|
||||
},
|
||||
{
|
||||
name: "MIT license URL (http)",
|
||||
url: "http://opensource.org/licenses/MIT",
|
||||
wantID: "MIT",
|
||||
wantFound: true,
|
||||
},
|
||||
{
|
||||
name: "Apache 2.0 license URL",
|
||||
url: "https://www.apache.org/licenses/LICENSE-2.0",
|
||||
wantID: "Apache-2.0",
|
||||
wantFound: true,
|
||||
},
|
||||
{
|
||||
name: "GPL 3.0 or later URL",
|
||||
url: "https://www.gnu.org/licenses/gpl-3.0-standalone.html",
|
||||
wantID: "GPL-3.0-or-later",
|
||||
wantFound: true,
|
||||
},
|
||||
{
|
||||
name: "BSD 3-Clause URL",
|
||||
url: "https://opensource.org/licenses/BSD-3-Clause",
|
||||
wantID: "BSD-3-Clause",
|
||||
wantFound: true,
|
||||
},
|
||||
{
|
||||
name: "URL with trailing whitespace",
|
||||
url: " http://opensource.org/licenses/MIT ",
|
||||
wantID: "MIT",
|
||||
wantFound: true,
|
||||
},
|
||||
{
|
||||
name: "Unknown URL",
|
||||
url: "https://example.com/unknown-license",
|
||||
wantID: "",
|
||||
wantFound: false,
|
||||
},
|
||||
{
|
||||
name: "Empty URL",
|
||||
url: "",
|
||||
wantID: "",
|
||||
wantFound: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
info, found := LicenseByURL(tt.url)
|
||||
if found != tt.wantFound {
|
||||
t.Errorf("LicenseByURL() found = %v, want %v", found, tt.wantFound)
|
||||
}
|
||||
if found {
|
||||
if info.ID != tt.wantID {
|
||||
t.Errorf("LicenseByURL() ID = %v, want %v", info.ID, tt.wantID)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestLicenseByURL_DeprecatedLicenses(t *testing.T) {
|
||||
// Test that deprecated license URLs map to their replacement licenses
|
||||
// For example, GPL-2.0+ should map to GPL-2.0-or-later
|
||||
|
||||
// This test needs actual URLs from deprecated licenses
|
||||
// We can verify by checking if a deprecated license URL maps to a non-deprecated ID
|
||||
url := "https://www.gnu.org/licenses/old-licenses/gpl-2.0-standalone.html"
|
||||
info, found := LicenseByURL(url)
|
||||
|
||||
if found {
|
||||
// Check that we got a valid non-deprecated license ID
|
||||
if info.ID == "" {
|
||||
t.Error("Got empty license ID for deprecated license URL")
|
||||
}
|
||||
// The ID should be the replacement (GPL-2.0-only or GPL-2.0-or-later)
|
||||
// depending on the URL
|
||||
t.Logf("Deprecated license URL mapped to: ID=%s", info.ID)
|
||||
}
|
||||
}
|
||||
+142
-2
@@ -2,7 +2,7 @@
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
elementFormDefault="qualified"
|
||||
targetNamespace="http://cyclonedx.org/schema/spdx"
|
||||
version="1.0-3.24.0">
|
||||
version="1.0-3.26.0">
|
||||
|
||||
<xs:simpleType name="licenseId">
|
||||
<xs:restriction base="xs:string">
|
||||
@@ -162,6 +162,11 @@
|
||||
<xs:documentation>Any OSI License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="any-OSI-perl-modules">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Any OSI License - Perl Modules</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Apache-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Apache License 1.0</xs:documentation>
|
||||
@@ -307,6 +312,11 @@
|
||||
<xs:documentation>Boehm-Demers-Weiser GC License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Boehm-GC-without-fee">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Boehm-Demers-Weiser GC License (without fee)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Borceux">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Borceux license</xs:documentation>
|
||||
@@ -812,6 +822,16 @@
|
||||
<xs:documentation>Creative Commons Public Domain Dedication and Certification</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CC-PDM-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Creative Commons Public Domain Mark 1.0 Universal</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CC-SA-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Creative Commons Share Alike 1.0 Generic</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CC0-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Creative Commons Zero v1.0 Universal</xs:documentation>
|
||||
@@ -1062,6 +1082,21 @@
|
||||
<xs:documentation>DOC License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="DocBook-Schema">
|
||||
<xs:annotation>
|
||||
<xs:documentation>DocBook Schema License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="DocBook-Stylesheet">
|
||||
<xs:annotation>
|
||||
<xs:documentation>DocBook Stylesheet License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="DocBook-XML">
|
||||
<xs:annotation>
|
||||
<xs:documentation>DocBook XML License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Dotseqn">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Dotseqn License</xs:documentation>
|
||||
@@ -1267,6 +1302,11 @@
|
||||
<xs:documentation>GD License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="generic-xts">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Generic XTS License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="GFDL-1.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>GNU Free Documentation License v1.1</xs:documentation>
|
||||
@@ -1527,6 +1567,11 @@
|
||||
<xs:documentation>hdparm License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HIDAPI">
|
||||
<xs:annotation>
|
||||
<xs:documentation>HIDAPI License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Hippocratic-2.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Hippocratic License 2.1</xs:documentation>
|
||||
@@ -1617,6 +1662,11 @@
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer with MIT disclaimer</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-Netrek">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - Netrek variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="HPND-Pbmplus">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Historical Permission Notice and Disclaimer - Pbmplus variant</xs:documentation>
|
||||
@@ -1712,6 +1762,11 @@
|
||||
<xs:documentation>Inner Net License v2.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="InnoSetup">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Inno Setup License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Intel">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Intel Open Source License</xs:documentation>
|
||||
@@ -2052,6 +2107,11 @@
|
||||
<xs:documentation>Minpack License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MIPS">
|
||||
<xs:annotation>
|
||||
<xs:documentation>MIPS License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MirOS">
|
||||
<xs:annotation>
|
||||
<xs:documentation>The MirOS Licence</xs:documentation>
|
||||
@@ -2072,6 +2132,11 @@
|
||||
<xs:documentation>Enlightenment License (e16)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MIT-Click">
|
||||
<xs:annotation>
|
||||
<xs:documentation>MIT Click License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="MIT-CMU">
|
||||
<xs:annotation>
|
||||
<xs:documentation>CMU License</xs:documentation>
|
||||
@@ -2772,6 +2837,11 @@
|
||||
<xs:documentation>Ruby License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Ruby-pty">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Ruby pty extension license</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SAX-PD">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Sax Public Domain Notice</xs:documentation>
|
||||
@@ -2807,6 +2877,11 @@
|
||||
<xs:documentation>Sendmail License 8.23</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Sendmail-Open-Source-1.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Sendmail Open Source License v1.1</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SGI-B-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>SGI Free Software License B v1.0</xs:documentation>
|
||||
@@ -2867,6 +2942,11 @@
|
||||
<xs:documentation>Sleepycat License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SMAIL-GPL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>SMAIL General Public License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="SMLNJ">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Standard ML of New Jersey License</xs:documentation>
|
||||
@@ -3007,6 +3087,11 @@
|
||||
<xs:documentation>Transitive Grace Period Public Licence 1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="ThirdEye">
|
||||
<xs:annotation>
|
||||
<xs:documentation>ThirdEye License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="threeparttable">
|
||||
<xs:annotation>
|
||||
<xs:documentation>threeparttable License</xs:documentation>
|
||||
@@ -3037,6 +3122,11 @@
|
||||
<xs:documentation>THOR Public License 1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="TrustedQSL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>TrustedQSL License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="TTWL">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Text-Tabs+Wrap License</xs:documentation>
|
||||
@@ -3057,6 +3147,11 @@
|
||||
<xs:documentation>Technische Universitaet Berlin License 2.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Ubuntu-font-1.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Ubuntu Font Licence v1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="UCAR">
|
||||
<xs:annotation>
|
||||
<xs:documentation>UCAR License</xs:documentation>
|
||||
@@ -3172,6 +3267,11 @@
|
||||
<xs:documentation>Do What The F*ck You Want To Public License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="wwl">
|
||||
<xs:annotation>
|
||||
<xs:documentation>WWL License</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="wxWindows">
|
||||
<xs:annotation>
|
||||
<xs:documentation>wxWindows Library License</xs:documentation>
|
||||
@@ -3187,6 +3287,11 @@
|
||||
<xs:documentation>X11 License Distribution Modification Variant</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="X11-swapped">
|
||||
<xs:annotation>
|
||||
<xs:documentation>X11 swapped final paragraphs</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Xdebug-1.03">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Xdebug License v 1.03</xs:documentation>
|
||||
@@ -3358,6 +3463,11 @@
|
||||
<xs:documentation>Bootloader Distribution Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="CGAL-linking-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>CGAL Linking Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Classpath-exception-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Classpath exception 2.0</xs:documentation>
|
||||
@@ -3383,6 +3493,11 @@
|
||||
<xs:documentation>eCos exception 2.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="erlang-otp-linking-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Erlang/OTP Linking Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Fawkes-Runtime-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Fawkes Runtime Exception</xs:documentation>
|
||||
@@ -3425,7 +3540,7 @@
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Gmsh-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Gmsh exception></xs:documentation>
|
||||
<xs:documentation>Gmsh exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="GNAT-exception">
|
||||
@@ -3448,6 +3563,11 @@
|
||||
<xs:documentation>GNU JavaMail exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="GPL-3.0-389-ds-base-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>GPL-3.0 389 DS Base Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="GPL-3.0-interface-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>GPL-3.0 Interface Exception</xs:documentation>
|
||||
@@ -3478,11 +3598,21 @@
|
||||
<xs:documentation>GStreamer Exception (2008)</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="harbour-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>harbour exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="i2p-gpl-java-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>i2p GPL+Java Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Independent-modules-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Independent Module Linking exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="KiCad-libraries-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>KiCad Libraries Exception</xs:documentation>
|
||||
@@ -3528,6 +3658,11 @@
|
||||
<xs:documentation>Macros and Inline Functions Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="mxml-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>mxml Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="Nokia-Qt-exception-1.1">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Nokia Qt LGPL exception 1.1</xs:documentation>
|
||||
@@ -3583,6 +3718,11 @@
|
||||
<xs:documentation>Qwt exception 1.0</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="romic-exception">
|
||||
<xs:annotation>
|
||||
<xs:documentation>Romic Exception</xs:documentation>
|
||||
</xs:annotation>
|
||||
</xs:enumeration>
|
||||
<xs:enumeration value="RRDtool-FLOSS-exception-2.0">
|
||||
<xs:annotation>
|
||||
<xs:documentation>RRDtool FLOSS exception 2.0</xs:documentation>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "anchore.io/schema/syft/json/16.0.36/document",
|
||||
"$id": "anchore.io/schema/syft/json/16.0.37/document",
|
||||
"$ref": "#/$defs/Document",
|
||||
"$defs": {
|
||||
"AlpmDbEntry": {
|
||||
@@ -3047,6 +3047,9 @@
|
||||
"version": {
|
||||
"type": "string"
|
||||
},
|
||||
"supplier": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": {
|
||||
"type": "string"
|
||||
},
|
||||
|
||||
@@ -48,7 +48,7 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM {
|
||||
packages := s.Artifacts.Packages.Sorted()
|
||||
components := make([]cyclonedx.Component, len(packages))
|
||||
for i, p := range packages {
|
||||
components[i] = helpers.EncodeComponent(p, locationSorter)
|
||||
components[i] = helpers.EncodeComponent(p, s.Source.Supplier, locationSorter)
|
||||
}
|
||||
components = append(components, toOSComponent(s.Artifacts.LinuxDistribution)...)
|
||||
|
||||
@@ -220,11 +220,22 @@ func toBomDescriptor(name, version string, srcMetadata source.Description) *cycl
|
||||
},
|
||||
},
|
||||
},
|
||||
Supplier: toBomSupplier(srcMetadata),
|
||||
Properties: toBomProperties(srcMetadata),
|
||||
Component: toBomDescriptorComponent(srcMetadata),
|
||||
}
|
||||
}
|
||||
|
||||
func toBomSupplier(srcMetadata source.Description) *cyclonedx.OrganizationalEntity {
|
||||
if srcMetadata.Supplier != "" {
|
||||
return &cyclonedx.OrganizationalEntity{
|
||||
Name: srcMetadata.Supplier,
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// used to indicate that a relationship listed under the syft artifact package can be represented as a cyclonedx dependency.
|
||||
// NOTE: CycloneDX provides the ability to describe components and their dependency on other components.
|
||||
// The dependency graph is capable of representing both direct and transitive relationships.
|
||||
@@ -321,10 +332,11 @@ func toBomDescriptorComponent(srcMetadata source.Description) *cyclonedx.Compone
|
||||
log.Debugf("unable to get fingerprint of source image metadata=%s: %+v", metadata.ID, err)
|
||||
}
|
||||
return &cyclonedx.Component{
|
||||
BOMRef: string(bomRef),
|
||||
Type: cyclonedx.ComponentTypeContainer,
|
||||
Name: name,
|
||||
Version: version,
|
||||
BOMRef: string(bomRef),
|
||||
Type: cyclonedx.ComponentTypeContainer,
|
||||
Name: name,
|
||||
Version: version,
|
||||
Supplier: toBomSupplier(srcMetadata),
|
||||
}
|
||||
case source.DirectoryMetadata:
|
||||
if name == "" {
|
||||
@@ -337,9 +349,10 @@ func toBomDescriptorComponent(srcMetadata source.Description) *cyclonedx.Compone
|
||||
return &cyclonedx.Component{
|
||||
BOMRef: string(bomRef),
|
||||
// TODO: this is lossy... we can't know if this is a file or a directory
|
||||
Type: cyclonedx.ComponentTypeFile,
|
||||
Name: name,
|
||||
Version: version,
|
||||
Type: cyclonedx.ComponentTypeFile,
|
||||
Name: name,
|
||||
Version: version,
|
||||
Supplier: toBomSupplier(srcMetadata),
|
||||
}
|
||||
case source.FileMetadata:
|
||||
if name == "" {
|
||||
@@ -352,9 +365,10 @@ func toBomDescriptorComponent(srcMetadata source.Description) *cyclonedx.Compone
|
||||
return &cyclonedx.Component{
|
||||
BOMRef: string(bomRef),
|
||||
// TODO: this is lossy... we can't know if this is a file or a directory
|
||||
Type: cyclonedx.ComponentTypeFile,
|
||||
Name: name,
|
||||
Version: version,
|
||||
Type: cyclonedx.ComponentTypeFile,
|
||||
Name: name,
|
||||
Version: version,
|
||||
Supplier: toBomSupplier(srcMetadata),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -389,7 +389,69 @@ func Test_toBomDescriptor(t *testing.T) {
|
||||
Name: "syft:image:labels:key1",
|
||||
Value: "value1",
|
||||
},
|
||||
}},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "with optional supplier is on the root component and bom metadata",
|
||||
args: args{
|
||||
name: "test-image",
|
||||
version: "1.0.0",
|
||||
srcMetadata: source.Description{
|
||||
Name: "test-image",
|
||||
Version: "1.0.0",
|
||||
Supplier: "optional-supplier",
|
||||
Metadata: source.ImageMetadata{},
|
||||
},
|
||||
},
|
||||
want: &cyclonedx.Metadata{
|
||||
Timestamp: "",
|
||||
Lifecycles: nil,
|
||||
Tools: &cyclonedx.ToolsChoice{
|
||||
Components: &[]cyclonedx.Component{
|
||||
{
|
||||
Type: cyclonedx.ComponentTypeApplication,
|
||||
Author: "anchore",
|
||||
Name: "test-image",
|
||||
Version: "1.0.0",
|
||||
},
|
||||
},
|
||||
},
|
||||
Authors: nil,
|
||||
Component: &cyclonedx.Component{
|
||||
BOMRef: "",
|
||||
MIMEType: "",
|
||||
Type: "container",
|
||||
Supplier: &cyclonedx.OrganizationalEntity{
|
||||
Name: "optional-supplier",
|
||||
},
|
||||
Author: "",
|
||||
Publisher: "",
|
||||
Group: "",
|
||||
Name: "test-image",
|
||||
Version: "1.0.0",
|
||||
Description: "",
|
||||
Scope: "",
|
||||
Hashes: nil,
|
||||
Licenses: nil,
|
||||
Copyright: "",
|
||||
CPE: "",
|
||||
PackageURL: "",
|
||||
SWID: nil,
|
||||
Modified: nil,
|
||||
Pedigree: nil,
|
||||
ExternalReferences: nil,
|
||||
Properties: nil,
|
||||
Components: nil,
|
||||
Evidence: nil,
|
||||
ReleaseNotes: nil,
|
||||
},
|
||||
Manufacture: nil,
|
||||
Supplier: &cyclonedx.OrganizationalEntity{
|
||||
Name: "optional-supplier",
|
||||
},
|
||||
Licenses: nil,
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
|
||||
@@ -257,13 +257,11 @@ func toRootPackage(s source.Description) *spdx.Package {
|
||||
PackageChecksums: checksums,
|
||||
PackageExternalReferences: nil,
|
||||
PrimaryPackagePurpose: purpose,
|
||||
PackageSupplier: &spdx.Supplier{
|
||||
Supplier: helpers.NOASSERTION,
|
||||
},
|
||||
PackageCopyrightText: helpers.NOASSERTION,
|
||||
PackageDownloadLocation: helpers.NOASSERTION,
|
||||
PackageLicenseConcluded: helpers.NOASSERTION,
|
||||
PackageLicenseDeclared: helpers.NOASSERTION,
|
||||
PackageSupplier: toSPDXSupplier(s),
|
||||
PackageCopyrightText: helpers.NOASSERTION,
|
||||
PackageDownloadLocation: helpers.NOASSERTION,
|
||||
PackageLicenseConcluded: helpers.NOASSERTION,
|
||||
PackageLicenseDeclared: helpers.NOASSERTION,
|
||||
}
|
||||
|
||||
if purl != nil {
|
||||
@@ -327,6 +325,23 @@ func toSPDXID(identifiable artifact.Identifiable) spdx.ElementID {
|
||||
return spdx.ElementID(helpers.SanitizeElementID(id))
|
||||
}
|
||||
|
||||
func toSPDXSupplier(s source.Description) *spdx.Supplier {
|
||||
supplier := helpers.NOASSERTION
|
||||
if s.Supplier != "" {
|
||||
supplier = s.Supplier
|
||||
}
|
||||
|
||||
supplierType := ""
|
||||
if supplier != helpers.NOASSERTION {
|
||||
supplierType = helpers.SUPPLIERORG
|
||||
}
|
||||
|
||||
return &spdx.Supplier{
|
||||
Supplier: supplier,
|
||||
SupplierType: supplierType,
|
||||
}
|
||||
}
|
||||
|
||||
// packages populates all Package Information from the package Collection (see https://spdx.github.io/spdx-spec/3-package-information/)
|
||||
//
|
||||
//nolint:funlen
|
||||
@@ -391,7 +406,7 @@ func toPackages(rels *relationship.Index, catalog *pkg.Collection, sbom sbom.SBO
|
||||
// 7.6: Package Originator: may have single result for either Person or Organization,
|
||||
// or NOASSERTION
|
||||
// Cardinality: optional, one
|
||||
PackageSupplier: toPackageSupplier(p),
|
||||
PackageSupplier: toPackageSupplier(p, sbom.Source.Supplier),
|
||||
|
||||
PackageOriginator: toPackageOriginator(p),
|
||||
|
||||
@@ -556,11 +571,18 @@ func toPackageOriginator(p pkg.Package) *spdx.Originator {
|
||||
}
|
||||
}
|
||||
|
||||
func toPackageSupplier(p pkg.Package) *spdx.Supplier {
|
||||
func toPackageSupplier(p pkg.Package, sbomSupplier string) *spdx.Supplier {
|
||||
kind, supplier := helpers.Supplier(p)
|
||||
if kind == "" || supplier == "" {
|
||||
supplier := helpers.NOASSERTION
|
||||
supplierType := ""
|
||||
if sbomSupplier != "" {
|
||||
supplier = sbomSupplier
|
||||
supplierType = helpers.SUPPLIERORG
|
||||
}
|
||||
return &spdx.Supplier{
|
||||
Supplier: helpers.NOASSERTION,
|
||||
Supplier: supplier,
|
||||
SupplierType: supplierType,
|
||||
}
|
||||
}
|
||||
return &spdx.Supplier{
|
||||
|
||||
@@ -36,8 +36,9 @@ func Test_toFormatModel(t *testing.T) {
|
||||
name: "container",
|
||||
in: sbom.SBOM{
|
||||
Source: source.Description{
|
||||
Name: "alpine",
|
||||
Version: "sha256:d34db33f",
|
||||
Name: "alpine",
|
||||
Version: "sha256:d34db33f",
|
||||
Supplier: "Alpine Linux",
|
||||
Metadata: source.ImageMetadata{
|
||||
UserInput: "alpine:latest",
|
||||
ManifestDigest: "sha256:d34db33f",
|
||||
@@ -61,7 +62,8 @@ func Test_toFormatModel(t *testing.T) {
|
||||
PackageName: "pkg-1",
|
||||
PackageVersion: "version-1",
|
||||
PackageSupplier: &spdx.Supplier{
|
||||
Supplier: "NOASSERTION",
|
||||
Supplier: "Alpine Linux",
|
||||
SupplierType: "Organization",
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -78,7 +80,8 @@ func Test_toFormatModel(t *testing.T) {
|
||||
},
|
||||
},
|
||||
PackageSupplier: &spdx.Supplier{
|
||||
Supplier: "NOASSERTION",
|
||||
Supplier: "Alpine Linux",
|
||||
SupplierType: "Organization",
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
@@ -145,10 +145,21 @@ func containerSource(p *spdx.Package) source.Description {
|
||||
c := p.PackageChecksums[0]
|
||||
digest = fmt.Sprintf("%s:%s", fromChecksumAlgorithm(c.Algorithm), c.Value)
|
||||
}
|
||||
|
||||
supplier := ""
|
||||
if p.PackageSupplier != nil {
|
||||
// we also don't want NOASSERTION transferred to the syft format
|
||||
// NOASSERTION == ""
|
||||
if p.PackageSupplier.Supplier != helpers.NOASSERTION && p.PackageSupplier.SupplierType == helpers.SUPPLIERORG {
|
||||
supplier = p.PackageSupplier.Supplier
|
||||
}
|
||||
}
|
||||
|
||||
return source.Description{
|
||||
ID: id,
|
||||
Name: p.PackageName,
|
||||
Version: p.PackageVersion,
|
||||
ID: id,
|
||||
Name: p.PackageName,
|
||||
Version: p.PackageVersion,
|
||||
Supplier: supplier,
|
||||
Metadata: source.ImageMetadata{
|
||||
UserInput: container,
|
||||
ID: id,
|
||||
@@ -179,10 +190,16 @@ func fileSource(p *spdx.Package) source.Description {
|
||||
metadata, version = fileSourceMetadata(p)
|
||||
}
|
||||
|
||||
supplier := ""
|
||||
if p.PackageSupplier.Supplier != helpers.NOASSERTION {
|
||||
supplier = p.PackageSupplier.Supplier
|
||||
}
|
||||
|
||||
return source.Description{
|
||||
ID: string(p.PackageSPDXIdentifier),
|
||||
Name: p.PackageName,
|
||||
Version: version,
|
||||
Supplier: supplier,
|
||||
Metadata: metadata,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -525,17 +525,19 @@ func Test_convertToAndFromFormat(t *testing.T) {
|
||||
UserInput: "some-image:some-tag",
|
||||
ManifestDigest: "sha256:ab8b83234bc28f28d8e",
|
||||
},
|
||||
Name: "some-image",
|
||||
Version: "some-tag",
|
||||
Name: "some-image",
|
||||
Version: "some-tag",
|
||||
Supplier: "some-supplier",
|
||||
},
|
||||
packages: packages,
|
||||
relationships: relationships,
|
||||
},
|
||||
{
|
||||
name: ". directory source",
|
||||
name: ". directory source with supplier",
|
||||
source: source.Description{
|
||||
ID: "DocumentRoot-Directory-.",
|
||||
Name: ".",
|
||||
ID: "DocumentRoot-Directory-.",
|
||||
Name: ".",
|
||||
Supplier: "some-supplier",
|
||||
Metadata: source.DirectoryMetadata{
|
||||
Path: ".",
|
||||
},
|
||||
@@ -544,7 +546,7 @@ func Test_convertToAndFromFormat(t *testing.T) {
|
||||
relationships: relationships,
|
||||
},
|
||||
{
|
||||
name: "directory source",
|
||||
name: "directory source without supplier",
|
||||
source: source.Description{
|
||||
ID: "DocumentRoot-Directory-my-app",
|
||||
Name: "my-app",
|
||||
|
||||
@@ -14,7 +14,7 @@ import (
|
||||
"github.com/anchore/syft/syft/pkg"
|
||||
)
|
||||
|
||||
func EncodeComponent(p pkg.Package, locationSorter func(a, b file.Location) int) cyclonedx.Component {
|
||||
func EncodeComponent(p pkg.Package, supplier string, locationSorter func(a, b file.Location) int) cyclonedx.Component {
|
||||
props := EncodeProperties(p, "syft:package")
|
||||
|
||||
if p.Metadata != nil {
|
||||
@@ -49,6 +49,7 @@ func EncodeComponent(p pkg.Package, locationSorter func(a, b file.Location) int)
|
||||
Name: p.Name,
|
||||
Group: encodeGroup(p),
|
||||
Version: p.Version,
|
||||
Supplier: encodeSupplier(p, supplier),
|
||||
PackageURL: p.PURL,
|
||||
Licenses: encodeLicenses(p),
|
||||
CPE: encodeSingleCPE(p),
|
||||
@@ -61,6 +62,16 @@ func EncodeComponent(p pkg.Package, locationSorter func(a, b file.Location) int)
|
||||
}
|
||||
}
|
||||
|
||||
// TODO: we eventually want to update this so that we can read "supplier" from different syft metadata
|
||||
func encodeSupplier(_ pkg.Package, sbomSupplier string) *cyclonedx.OrganizationalEntity {
|
||||
if sbomSupplier != "" {
|
||||
return &cyclonedx.OrganizationalEntity{
|
||||
Name: sbomSupplier,
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func DeriveBomRef(p pkg.Package) string {
|
||||
// try and parse the PURL if possible and append syft id to it, to make
|
||||
// the purl unique in the BOM.
|
||||
|
||||
@@ -152,7 +152,8 @@ func Test_encodeComponentProperties(t *testing.T) {
|
||||
}
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
c := EncodeComponent(test.input, file.LocationSorter(nil))
|
||||
sbomSupplier := ""
|
||||
c := EncodeComponent(test.input, sbomSupplier, file.LocationSorter(nil))
|
||||
if test.expected == nil {
|
||||
if c.Properties != nil {
|
||||
t.Fatalf("expected no properties, got: %+v", *c.Properties)
|
||||
@@ -212,7 +213,8 @@ func Test_encodeCompomentType(t *testing.T) {
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
tt.pkg.ID()
|
||||
p := EncodeComponent(tt.pkg, file.LocationSorter(nil))
|
||||
sbomSupplier := ""
|
||||
p := EncodeComponent(tt.pkg, sbomSupplier, file.LocationSorter(nil))
|
||||
assert.Equal(t, tt.want, p)
|
||||
})
|
||||
}
|
||||
|
||||
@@ -211,6 +211,16 @@ func extractComponents(meta *cyclonedx.Metadata) source.Description {
|
||||
}
|
||||
c := meta.Component
|
||||
|
||||
supplier := ""
|
||||
// First check component-level supplier
|
||||
if c.Supplier != nil && c.Supplier.Name != "" {
|
||||
supplier = c.Supplier.Name
|
||||
}
|
||||
// Fall back to metadata-level supplier if component supplier is not set
|
||||
if supplier == "" && meta.Supplier != nil && meta.Supplier.Name != "" {
|
||||
supplier = meta.Supplier.Name
|
||||
}
|
||||
|
||||
switch c.Type {
|
||||
case cyclonedx.ComponentTypeContainer:
|
||||
var labels map[string]string
|
||||
@@ -220,7 +230,8 @@ func extractComponents(meta *cyclonedx.Metadata) source.Description {
|
||||
}
|
||||
|
||||
return source.Description{
|
||||
ID: "",
|
||||
ID: "",
|
||||
Supplier: supplier,
|
||||
// TODO: can we decode alias name-version somehow? (it isn't be encoded in the first place yet)
|
||||
|
||||
Metadata: source.ImageMetadata{
|
||||
@@ -236,6 +247,7 @@ func extractComponents(meta *cyclonedx.Metadata) source.Description {
|
||||
// TODO: this is lossy... we can't know if this is a file or a directory
|
||||
return source.Description{
|
||||
ID: "",
|
||||
Supplier: supplier,
|
||||
Metadata: source.FileMetadata{Path: c.Name},
|
||||
}
|
||||
}
|
||||
|
||||
@@ -62,6 +62,9 @@ func decodeLicenses(c *cyclonedx.Component) []pkg.License {
|
||||
licenses = append(licenses, pkg.NewLicenseFromURLsWithContext(context.TODO(), l.License.ID, l.License.URL))
|
||||
case l.License != nil && l.License.Name != "":
|
||||
licenses = append(licenses, pkg.NewLicenseFromURLsWithContext(context.TODO(), l.License.Name, l.License.URL))
|
||||
case l.License != nil && l.License.URL != "":
|
||||
// Try to enrich license from URL when ID and Name are empty
|
||||
licenses = append(licenses, pkg.NewLicenseFromURLsWithContext(context.TODO(), "", l.License.URL))
|
||||
case l.Expression != "":
|
||||
licenses = append(licenses, pkg.NewLicenseWithContext(context.TODO(), l.Expression))
|
||||
default:
|
||||
@@ -163,10 +166,18 @@ func processCustomLicense(l pkg.License) cyclonedx.Licenses {
|
||||
func processLicenseURLs(l pkg.License, spdxID string, populate *cyclonedx.Licenses) {
|
||||
for _, url := range l.URLs {
|
||||
if spdxID == "" {
|
||||
// CycloneDX requires either an id or name to be present for a license
|
||||
// If l.Value is empty, use the URL as the name to ensure schema compliance
|
||||
// at this point we've already tried to enrich the license we just don't want the format
|
||||
// conversion to be lossy here
|
||||
name := l.Value
|
||||
if name == "" {
|
||||
name = url
|
||||
}
|
||||
*populate = append(*populate, cyclonedx.LicenseChoice{
|
||||
License: &cyclonedx.License{
|
||||
URL: url,
|
||||
Name: l.Value,
|
||||
Name: name,
|
||||
},
|
||||
})
|
||||
} else {
|
||||
|
||||
@@ -121,6 +121,22 @@ func Test_encodeLicense(t *testing.T) {
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "with URL only and no name or SPDX ID",
|
||||
input: pkg.Package{
|
||||
Licenses: pkg.NewLicenseSet(
|
||||
pkg.NewLicenseFromURLsWithContext(ctx, "", "http://jaxen.codehaus.org/license.html"),
|
||||
),
|
||||
},
|
||||
expected: &cyclonedx.Licenses{
|
||||
{
|
||||
License: &cyclonedx.License{
|
||||
Name: "http://jaxen.codehaus.org/license.html",
|
||||
URL: "http://jaxen.codehaus.org/license.html",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "with multiple values licenses are deduplicated",
|
||||
input: pkg.Package{
|
||||
|
||||
@@ -10,6 +10,7 @@ import (
|
||||
|
||||
const NONE = "NONE"
|
||||
const NOASSERTION = "NOASSERTION"
|
||||
const SUPPLIERORG = "Organization"
|
||||
|
||||
func DownloadLocation(p pkg.Package) string {
|
||||
// 3.7: Package Download Location
|
||||
|
||||
@@ -12,10 +12,16 @@ import (
|
||||
)
|
||||
|
||||
// Source object represents the thing that was cataloged
|
||||
// Note: syft currently makes no claims or runs any logic to determine the Supplier field below
|
||||
|
||||
// Instead, the Supplier can be determined by the user of syft and passed as a config or flag to help fulfill
|
||||
// the NTIA minimum elements. For mor information see the NTIA framing document below
|
||||
// https://www.ntia.gov/files/ntia/publications/framingsbom_20191112.pdf
|
||||
type Source struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
Version string `json:"version"`
|
||||
Supplier string `json:"supplier,omitempty"`
|
||||
Type string `json:"type"`
|
||||
Metadata interface{} `json:"metadata"`
|
||||
}
|
||||
@@ -25,6 +31,7 @@ type sourceUnpacker struct {
|
||||
ID string `json:"id,omitempty"`
|
||||
Name string `json:"name"`
|
||||
Version string `json:"version"`
|
||||
Supplier string `json:"supplier,omitempty"`
|
||||
Type string `json:"type"`
|
||||
Metadata json.RawMessage `json:"metadata"`
|
||||
Target json.RawMessage `json:"target"` // pre-v9 schema support
|
||||
@@ -40,6 +47,7 @@ func (s *Source) UnmarshalJSON(b []byte) error {
|
||||
|
||||
s.Name = unpacker.Name
|
||||
s.Version = unpacker.Version
|
||||
s.Supplier = unpacker.Supplier
|
||||
s.Type = unpacker.Type
|
||||
s.ID = unpacker.ID
|
||||
|
||||
|
||||
@@ -320,6 +320,7 @@ func toSourceModel(src source.Description) model.Source {
|
||||
ID: src.ID,
|
||||
Name: src.Name,
|
||||
Version: src.Version,
|
||||
Supplier: src.Supplier,
|
||||
Type: sourcemetadata.JSONName(src.Metadata),
|
||||
Metadata: src.Metadata,
|
||||
}
|
||||
|
||||
@@ -56,19 +56,21 @@ func Test_toSourceModel(t *testing.T) {
|
||||
{
|
||||
name: "directory",
|
||||
src: source.Description{
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
Supplier: "optional-supplier",
|
||||
Metadata: source.DirectoryMetadata{
|
||||
Path: "some/path",
|
||||
Base: "some/base",
|
||||
},
|
||||
},
|
||||
expected: model.Source{
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
Type: "directory",
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
Supplier: "optional-supplier",
|
||||
Type: "directory",
|
||||
Metadata: source.DirectoryMetadata{
|
||||
Path: "some/path",
|
||||
Base: "some/base",
|
||||
@@ -78,9 +80,10 @@ func Test_toSourceModel(t *testing.T) {
|
||||
{
|
||||
name: "file",
|
||||
src: source.Description{
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
Supplier: "optional-supplier",
|
||||
Metadata: source.FileMetadata{
|
||||
Path: "some/path",
|
||||
Digests: []file.Digest{{Algorithm: "sha256", Value: "some-digest"}},
|
||||
@@ -88,10 +91,11 @@ func Test_toSourceModel(t *testing.T) {
|
||||
},
|
||||
},
|
||||
expected: model.Source{
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
Type: "file",
|
||||
ID: "test-id",
|
||||
Name: "some-name",
|
||||
Version: "some-version",
|
||||
Supplier: "optional-supplier",
|
||||
Type: "file",
|
||||
Metadata: source.FileMetadata{
|
||||
Path: "some/path",
|
||||
Digests: []file.Digest{{Algorithm: "sha256", Value: "some-digest"}},
|
||||
|
||||
@@ -315,6 +315,7 @@ func toSyftSourceData(s model.Source) *source.Description {
|
||||
ID: s.ID,
|
||||
Name: s.Name,
|
||||
Version: s.Version,
|
||||
Supplier: s.Supplier,
|
||||
Metadata: s.Metadata,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,6 +4,7 @@ package license
|
||||
import (
|
||||
"fmt"
|
||||
"runtime/debug"
|
||||
"strings"
|
||||
|
||||
"github.com/github/go-spdx/v2/spdxexp"
|
||||
|
||||
@@ -17,6 +18,18 @@ const (
|
||||
Concluded Type = "concluded"
|
||||
)
|
||||
|
||||
// trimFileSuffix removes common file extensions from the end of a string
|
||||
func trimFileSuffix(s string) string {
|
||||
suffixes := []string{".txt", ".pdf", ".html", ".htm", ".md", ".markdown", ".rst", ".doc", ".docx", ".rtf", ".tex", ".xml", ".json"}
|
||||
lower := strings.ToLower(s)
|
||||
for _, suffix := range suffixes {
|
||||
if strings.HasSuffix(lower, suffix) {
|
||||
return s[:len(s)-len(suffix)]
|
||||
}
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
func ParseExpression(expression string) (ex string, err error) {
|
||||
// https://github.com/anchore/syft/issues/1837
|
||||
// The current spdx library can panic when parsing some expressions
|
||||
@@ -28,10 +41,26 @@ func ParseExpression(expression string) (ex string, err error) {
|
||||
}
|
||||
}()
|
||||
|
||||
// Try with the original expression first
|
||||
licenseID, exists := spdxlicense.ID(expression)
|
||||
if exists {
|
||||
return licenseID, nil
|
||||
}
|
||||
|
||||
// Check if the expression is a URL and try to look it up
|
||||
if info, found := spdxlicense.LicenseByURL(expression); found {
|
||||
return info.ID, nil
|
||||
}
|
||||
|
||||
// Try with trimmed file suffix
|
||||
trimmed := trimFileSuffix(expression)
|
||||
if trimmed != expression {
|
||||
// Try as a URL with the trimmed version
|
||||
if info, found := spdxlicense.LicenseByURL(trimmed); found {
|
||||
return info.ID, nil
|
||||
}
|
||||
}
|
||||
|
||||
// If it doesn't exist initially in the SPDX list it might be a more complex expression
|
||||
// ignored variable is any invalid expressions
|
||||
// TODO: contribute to spdxexp to expose deprecated license IDs
|
||||
|
||||
@@ -75,6 +75,12 @@ func (c cataloger) Catalog(_ context.Context, resolver file.Resolver) ([]pkg.Pac
|
||||
newPackages:
|
||||
for i := range newPkgs {
|
||||
newPkg := &newPkgs[i]
|
||||
purlType := pkg.TypeFromPURL(newPkg.PURL)
|
||||
// for certain results, such as hashicorp vault we are returning a golang PURL, so we can use Golang package type,
|
||||
// despite not having the known metadata, this should result in downstream grype matching to use the golang matcher
|
||||
if purlType != pkg.UnknownPkg {
|
||||
newPkg.Type = purlType
|
||||
}
|
||||
for j := range packages {
|
||||
p := &packages[j]
|
||||
// consolidate identical packages found in different locations or by different classifiers
|
||||
@@ -92,6 +98,9 @@ func (c cataloger) Catalog(_ context.Context, resolver file.Resolver) ([]pkg.Pac
|
||||
|
||||
// mergePackages merges information from the extra package into the target package
|
||||
func mergePackages(target *pkg.Package, extra *pkg.Package) {
|
||||
if extra.Type != pkg.BinaryPkg && target.Type == pkg.BinaryPkg {
|
||||
target.Type = extra.Type
|
||||
}
|
||||
// add the locations
|
||||
target.Locations.Add(extra.Locations.ToSlice()...)
|
||||
// update the metadata to indicate which classifiers were used
|
||||
|
||||
@@ -775,39 +775,6 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("java-binary-oracle", "java"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "java-jre-ibm/1.8.0_391/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "java",
|
||||
Version: "1.8.0-foreman_2023_10_12_13_27-b00",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/ibm/java@1.8.0-foreman_2023_10_12_13_27-b00",
|
||||
Locations: locations("java"),
|
||||
Metadata: metadata("java-binary-ibm", "java"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "java-ibm-8-jre/1.8.0_451/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "java",
|
||||
Version: "1.8.0-_2025_04_14_02_37-b00",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/ibm/java@1.8.0-_2025_04_14_02_37-b00",
|
||||
Locations: locations("java"),
|
||||
Metadata: metadata("java-binary-ibm", "java"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "java-ibm-8-sdk-alpine/1.8.0_321/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "java_sdk",
|
||||
Version: "1.8.0-foreman_2022_01_20_09_33-b00",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/ibm/java_sdk@1.8.0-foreman_2022_01_20_09_33-b00",
|
||||
Locations: locations("jdb"),
|
||||
Metadata: metadata("java-sdk-binary-ibm", "jdb"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "java-jdk-openjdk/21.0.2+13-LTS/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -1007,6 +974,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("consul-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "vault/1.20.2/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
Name: "github.com/hashicorp/vault",
|
||||
Version: "1.20.2",
|
||||
Type: "golang",
|
||||
PURL: "pkg:golang/github.com/hashicorp/vault@1.20.2",
|
||||
Locations: locations("vault"),
|
||||
Metadata: metadata("hashicorp-vault-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "vault/1.19.4/linux-arm64",
|
||||
expected: pkg.Package{
|
||||
Name: "github.com/hashicorp/vault",
|
||||
Version: "1.19.4",
|
||||
Type: "golang",
|
||||
PURL: "pkg:golang/github.com/hashicorp/vault@1.19.4",
|
||||
Locations: locations("vault"),
|
||||
Metadata: metadata("hashicorp-vault-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "erlang/25.3.2.6/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
@@ -1194,6 +1183,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("openssl-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "openssl/1.1.1zb/linux-arm64",
|
||||
expected: pkg.Package{
|
||||
Name: "openssl",
|
||||
Version: "1.1.1zb",
|
||||
Type: "binary",
|
||||
PURL: "pkg:generic/openssl@1.1.1zb",
|
||||
Locations: locations("openssl"),
|
||||
Metadata: metadata("openssl-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
logicalFixture: "gcc/12.3.0/linux-amd64",
|
||||
expected: pkg.Package{
|
||||
|
||||
@@ -448,6 +448,16 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
PURL: mustPURL("pkg:golang/github.com/hashicorp/consul@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "hashicorp-vault-binary",
|
||||
FileGlob: "**/vault",
|
||||
EvidenceMatcher: m.FileContentsVersionMatcher(
|
||||
// revoke1.18.0
|
||||
`(?m)revoke(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
|
||||
Package: "github.com/hashicorp/vault",
|
||||
PURL: mustPURL("pkg:golang/github.com/hashicorp/vault@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "nginx-binary",
|
||||
FileGlob: "**/nginx",
|
||||
@@ -483,7 +493,7 @@ func DefaultClassifiers() []binutils.Classifier {
|
||||
EvidenceMatcher: m.FileContentsVersionMatcher(
|
||||
// [NUL]OpenSSL 3.1.4'
|
||||
// [NUL]OpenSSL 1.1.1w'
|
||||
`\x00OpenSSL (?P<version>[0-9]+\.[0-9]+\.[0-9]+([a-z]|-alpha[0-9]|-beta[0-9]|-rc[0-9])?)`,
|
||||
`\x00OpenSSL (?P<version>[0-9]+\.[0-9]+\.[0-9]+([a-z]+|-alpha[0-9]|-beta[0-9]|-rc[0-9])?)`,
|
||||
),
|
||||
Package: "openssl",
|
||||
PURL: mustPURL("pkg:generic/openssl@version"),
|
||||
|
||||
@@ -122,6 +122,23 @@ func defaultJavaClassifiers() []binutils.Classifier {
|
||||
PURL: mustPURL("pkg:generic/oracle/graalvm@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:oracle:graalvm_for_jdk:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "jdb-binary-openjdk-zulu",
|
||||
EvidenceMatcher: binutils.MatchAll(
|
||||
binutils.MatchPath("**/*zulu*/**"),
|
||||
binutils.MatchAny(
|
||||
m.FileContentsVersionMatcher(
|
||||
// [NUL]jdb[NUL]0.0[NUL]11.0.17+8-LTS[NUL]
|
||||
`(?m)(java|jdb)\x00(?P<release>[0-9]+[.0-9]*)\x00(?P<version>[0-9]+[^\x00]+)\x00`),
|
||||
m.FileContentsVersionMatcher(
|
||||
// arm64 versions: [NUL]0.0[NUL][NUL][NUL][NUL][NUL]11.0.22+7[NUL][NUL][NUL][NUL][NUL][NUL][NUL]jdb[NUL]
|
||||
`(?m)\x00(?P<release>[0-9]+[.0-9]*)\x00+(?P<version>[0-9]+[^\x00]+)\x00+(java|jdb)`),
|
||||
),
|
||||
),
|
||||
Package: "zulu",
|
||||
PURL: mustPURL("pkg:generic/azul/zulu@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "java-jdb-binary-openjdk",
|
||||
EvidenceMatcher: binutils.MatchAll(
|
||||
@@ -137,23 +154,6 @@ func defaultJavaClassifiers() []binutils.Classifier {
|
||||
PURL: mustPURL("pkg:generic/oracle/openjdk@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "jdb-binary-openjdk-zulu",
|
||||
EvidenceMatcher: binutils.MatchAll(
|
||||
binutils.MatchPath("**/*zulu*/**"),
|
||||
binutils.MatchAny(
|
||||
m.FileContentsVersionMatcher(
|
||||
// [NUL]openjdk[NUL]java[NUL]0.0[NUL]11.0.17+8-LTS[NUL]
|
||||
`(?m)\x00openjdk\x00java\x00(?P<release>[0-9]+[.0-9]*)\x00(?P<version>[0-9]+[^\x00]+)\x00`),
|
||||
m.FileContentsVersionMatcher(
|
||||
// arm64 versions: [NUL]0.0[NUL][NUL][NUL][NUL][NUL]11.0.22+7[NUL][NUL][NUL][NUL][NUL][NUL][NUL]openjdk[NUL]java[NUL]
|
||||
`(?m)\x00(?P<release>[0-9]+[.0-9]*)\x00+(?P<version>[0-9]+[^\x00]+)\x00+openjdk\x00java`),
|
||||
),
|
||||
),
|
||||
Package: "zulu",
|
||||
PURL: mustPURL("pkg:generic/azul/zulu@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:azul:zulu:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),
|
||||
},
|
||||
{
|
||||
Class: "java-sdk-binary-ibm",
|
||||
EvidenceMatcher: binutils.MatchAll(
|
||||
|
||||
@@ -0,0 +1,66 @@
|
||||
package binary
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
|
||||
)
|
||||
|
||||
func Test_JavaBinaryImage(t *testing.T) {
|
||||
tests := []struct {
|
||||
image string
|
||||
expected []string
|
||||
}{
|
||||
{
|
||||
image: "image-java-binary",
|
||||
expected: []string{
|
||||
"java @ 1.8.0-foreman_2022_09_22_15_30-b00 (/staged/positive/ibm/java)",
|
||||
"jre @ 19.0.1+10-21 (/staged/positive/oracle-macos/java)",
|
||||
"openjdk @ 1.8.0_352-b08 (/staged/positive/openjdk/java)",
|
||||
"openjdk @ 11.0.17+8-LTS (/staged/positive/openjdk-lts/java)",
|
||||
},
|
||||
},
|
||||
{
|
||||
image: "image-java-zulu-8",
|
||||
expected: []string{
|
||||
"zulu @ 1.8.0_462-b08 (/usr/lib/jvm/zulu8-ca-amd64/bin/jdb)",
|
||||
},
|
||||
},
|
||||
{
|
||||
image: "image-java-zulu-21",
|
||||
expected: []string{
|
||||
"zulu @ 21.0.8+9-LTS (/usr/lib/jvm/zulu21-ca-amd64/bin/java)",
|
||||
},
|
||||
},
|
||||
{
|
||||
image: "image-java-ibm-8",
|
||||
expected: []string{
|
||||
"java @ 1.8.0-foreman_2023_10_12_13_27-b00 (/opt/ibm/java/jre/bin/java)",
|
||||
},
|
||||
},
|
||||
{
|
||||
image: "image-java-ibm-jre-8",
|
||||
expected: []string{
|
||||
"java @ 1.8.0-_2025_04_14_02_37-b00 (/opt/ibm/java/jre/bin/java)",
|
||||
},
|
||||
},
|
||||
{
|
||||
image: "image-java-ibm-sdk-8",
|
||||
expected: []string{
|
||||
"java_sdk @ 1.8.0-foreman_2022_01_20_09_33-b00 (/opt/ibm/java/bin/jdb)",
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.image, func(t *testing.T) {
|
||||
c := NewClassifierCataloger(ClassifierCatalogerConfig{
|
||||
Classifiers: defaultJavaClassifiers(),
|
||||
})
|
||||
pkgtest.NewCatalogTester().
|
||||
WithImageResolver(t, tt.image).
|
||||
ExpectsPackageStrings(tt.expected).
|
||||
TestCataloger(t, c)
|
||||
})
|
||||
}
|
||||
}
|
||||
BIN
Binary file not shown.
+11
@@ -0,0 +1,11 @@
|
||||
name: vault
|
||||
offset: 191891817
|
||||
length: 420
|
||||
snippetSha256: fd8eb7979e1e7bbc254f2f7a26f6a70ecb479cc4f50c804f3b0789bc0e229097
|
||||
fileSha256: a4754a343e619adef87a1d7e1368a0709ba29802fefbe8d70105c11085becd43
|
||||
|
||||
### byte snippet to follow ###
|
||||
ctstreamPragma</a>.
|
||||
:httpssocks Locked%s.logCT_LOGLOCAL0@level[INFO][WARN]env:///v1/%sDELETEcreateErrorserrorsclient/data/lookupactualAcceptregionawskmsocikmspkcs11%s%s%scloud:%s.%s:revoke1.19.4)(nil))(%#v) {...}frenchCommonArabicBrahmiCarianChakmaCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphen\u%04x\U%08xgetentpasswd390625%s
|
||||
%s
|
||||
%q: %wnumber\uff
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
name: vault
|
||||
offset: 213670425
|
||||
length: 220
|
||||
snippetSha256: d9b23916d00e8085a4066974641ef77962f2e0aae6f4244688d2c4fe4286c92b
|
||||
fileSha256: fb484f1b458e5d2fd28270b406a8b26b28d040dddcaa1d099aa9ee4ac927b730
|
||||
|
||||
### byte snippet to follow ###
|
||||
ctstreamPragma</a>.
|
||||
:httpssocks Locked%s.logCT_LOGLOCAL0@level[INFO][WARN]env:///v1/%sDELETEcreateErrorserrorsclient/data/lookupactualAcceptregionawskmsocikmspkcs11%s%s%scloud:%s.%s:revoke1.20.2)(nil))(%#v) {...}frenchCo
|
||||
@@ -187,33 +187,6 @@ from-images:
|
||||
paths:
|
||||
- /usr/local/apache2/bin/httpd
|
||||
|
||||
- name: java-jre-ibm
|
||||
version: 1.8.0_391
|
||||
images:
|
||||
- ref: ibmjava:8@sha256:05ef6b0f754aa3a8cebcec36260a70c234a217b21240a998604f33459037bc08
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /opt/ibm/java/jre/bin/java
|
||||
- /opt/ibm/java/jre/lib/amd64/jli/libjli.so
|
||||
|
||||
- name: java-ibm-8-jre
|
||||
version: 1.8.0_451
|
||||
images:
|
||||
- ref: ibmjava:8-jre@sha256:3588cd1cc9b8646fe03b3b15210e69b1b520f1321f8518b69c0e7013d702fd23
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /opt/ibm/java/jre/bin/java
|
||||
- /opt/ibm/java/jre/lib/amd64/jli/libjli.so
|
||||
|
||||
- name: java-ibm-8-sdk-alpine
|
||||
version: 1.8.0_321
|
||||
images:
|
||||
- ref: ibmjava:8-sdk-alpine@sha256:4f8ad2029e78f7b91721745a77fc6011a7c0e09b9edeffb6b20b6ec34a6e63cd
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /opt/ibm/java/bin/jdb
|
||||
- /opt/ibm/java/lib/amd64/jli/libjli.so
|
||||
|
||||
- version: 10.6.15
|
||||
images:
|
||||
- ref: mariadb:10.6.15@sha256:92d499d9e02e92dc55c8160ef4004aa07f2e835197b18864ed214ca441e0dcfc
|
||||
@@ -724,6 +697,20 @@ from-images:
|
||||
paths:
|
||||
- /bin/consul
|
||||
|
||||
- version: 1.20.2
|
||||
images:
|
||||
- ref: hashicorp/vault@sha256:5cd2003247e0a574a66c66aee1916b1e9e7f99640298f2e61271a8842d2d2a19
|
||||
platform: linux/amd64
|
||||
paths:
|
||||
- /bin/vault
|
||||
|
||||
- version: 1.19.4
|
||||
images:
|
||||
- ref: hashicorp/vault@sha256:b5f675b0bf681568cd7354c697fe4ce953024312d6d23ee7216deda60c192bad
|
||||
platform: linux/arm64
|
||||
paths:
|
||||
- /bin/vault
|
||||
|
||||
- version: 3.0.2
|
||||
images:
|
||||
- ref: fluent/fluent-bit:3.0.2-amd64@sha256:7e6fe8efd51dda0739e355f58bf5e3b1623cbf2d4a23c06c7a365d9553e2d242
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
FROM anchore/test_images:syft_bin-cf22714@sha256:c27b02c6322180fd8a7a3097d2b430bfdf9ea52ecf136edf258458e82f2c6f21
|
||||
@@ -0,0 +1,6 @@
|
||||
FROM ibmjava:8@sha256:05ef6b0f754aa3a8cebcec36260a70c234a217b21240a998604f33459037bc08 AS builder
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /opt/ibm/java/jre/bin/java /opt/ibm/java/jre/bin/
|
||||
COPY --from=builder /opt/ibm/java/jre/lib/amd64/jli/libjli.so /opt/ibm/java/jre/lib/amd64/jli/
|
||||
@@ -0,0 +1,6 @@
|
||||
FROM ibmjava:8-jre@sha256:3588cd1cc9b8646fe03b3b15210e69b1b520f1321f8518b69c0e7013d702fd23 AS builder
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /opt/ibm/java/jre/bin/java /opt/ibm/java/jre/bin/
|
||||
COPY --from=builder /opt/ibm/java/jre/lib/amd64/jli/libjli.so /opt/ibm/java/jre/lib/amd64/jli/
|
||||
@@ -0,0 +1,6 @@
|
||||
FROM ibmjava:8-sdk-alpine@sha256:4f8ad2029e78f7b91721745a77fc6011a7c0e09b9edeffb6b20b6ec34a6e63cd AS builder
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /opt/ibm/java/bin/jdb /opt/ibm/java/bin/
|
||||
COPY --from=builder /opt/ibm/java/lib/amd64/jli/libjli.so /opt/ibm/java/lib/amd64/jli/
|
||||
@@ -0,0 +1,5 @@
|
||||
FROM azul/zulu-openjdk:21-jre-headless@sha256:581ebc852fcd9b52a5979b9b90dbe7cca2736bc1ecf1b9bd08ec41212d6675a4 AS builder
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /usr/lib/jvm/zulu21-ca-amd64/bin/java /usr/lib/jvm/zulu21-ca-amd64/bin/
|
||||
@@ -0,0 +1,5 @@
|
||||
FROM azul/zulu-openjdk:8-latest@sha256:7e3116bf36566e046b763b4a33f410f07f591bc84c391aae4f7891f5ecbb6764 AS builder
|
||||
|
||||
FROM scratch
|
||||
|
||||
COPY --from=builder /usr/lib/jvm/zulu8-ca-amd64/bin/jdb /usr/lib/jvm/zulu8-ca-amd64/bin/
|
||||
@@ -31,7 +31,7 @@ func BranchingEvidenceMatcher(classifiers ...Classifier) EvidenceMatcher {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return rdr, nil
|
||||
return &nonClosingUnionReader{rdr}, nil
|
||||
},
|
||||
})
|
||||
if len(pkgs) > 0 || err != nil {
|
||||
@@ -41,3 +41,11 @@ func BranchingEvidenceMatcher(classifiers ...Classifier) EvidenceMatcher {
|
||||
return nil, nil
|
||||
}
|
||||
}
|
||||
|
||||
type nonClosingUnionReader struct {
|
||||
unionreader.UnionReader
|
||||
}
|
||||
|
||||
func (c *nonClosingUnionReader) Close() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -61,6 +61,9 @@
|
||||
"github.com/gofiber/template/django/v3": [
|
||||
"cpe:2.3:a:gofiber:django:*:*:*:*:*:go:*:*"
|
||||
],
|
||||
"github.com/google/nftables": [
|
||||
"cpe:2.3:a:google:nftables:*:*:*:*:*:go:*:*"
|
||||
],
|
||||
"github.com/gookit/goutil": [
|
||||
"cpe:2.3:a:go_util_project:go_util:*:*:*:*:*:go:*:*"
|
||||
],
|
||||
@@ -10556,6 +10559,9 @@
|
||||
"drawblog": [
|
||||
"cpe:2.3:a:drawblog_project:drawblog:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"drive-folder-embeder": [
|
||||
"cpe:2.3:a:azumbro:drive_folder_embedder:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"droit-dark-mode": [
|
||||
"cpe:2.3:a:droitthemes:droit_dark_mode:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -11858,6 +11864,9 @@
|
||||
"furikake": [
|
||||
"cpe:2.3:a:furikake_project:furikake:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"fusedesk": [
|
||||
"cpe:2.3:a:jeremyshapiro:fusedesk:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"fusion-builder": [
|
||||
"cpe:2.3:a:theme-fusion:avada:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -12313,6 +12322,9 @@
|
||||
"gtbabel": [
|
||||
"cpe:2.3:a:gtbabel:gtbabel:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"gtg-advanced-blocks": [
|
||||
"cpe:2.3:a:gutengeek:free_gutenberg_blocks:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"gtm-server-side": [
|
||||
"cpe:2.3:a:stape:gtm_server_side:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -13133,6 +13145,12 @@
|
||||
"cpe:2.3:a:joomsky:js_help_desk:*:*:*:*:*:wordpress:*:*",
|
||||
"cpe:2.3:a:wiselyhub:js_help_desk:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"js_composer": [
|
||||
"cpe:2.3:a:wpbakery:page_builder:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"jsfiddle-shortcode": [
|
||||
"cpe:2.3:a:wvega:jsfiddle_shortcode:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"jsmol2wp": [
|
||||
"cpe:2.3:a:jsmol2wp_project:jsmol2wp:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -13639,9 +13657,41 @@
|
||||
"lokalyze-call-now": [
|
||||
"cpe:2.3:a:lokalyze:call_me_now:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-abf-freight-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:abf:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:abf_freight:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-globaltranz-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:globaltranz:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:ups:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-odfl-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:odfl:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-purolator-freight-edition": [
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:purolator:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-saia-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:saia:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-sefl-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:sefl:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:southeastern_freight_lines:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-unishippers-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:unishippers:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-ups-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:tforce:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:ups:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-worldwide-express-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:worldwide_express:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:worldwide_express:wordpress:*:*"
|
||||
],
|
||||
"ltl-freight-quotes-xpo-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:xpo:wordpress:*:*"
|
||||
],
|
||||
"lucas-string-replace": [
|
||||
"cpe:2.3:a:lucasstad:lucas_string_replace:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -13976,7 +14026,8 @@
|
||||
"cpe:2.3:a:mekshq:meks_flexible_shortcodes:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"meks-smart-author-widget": [
|
||||
"cpe:2.3:a:mekshq:meks_smart_author_widget:*:*:*:*:*:wordpress:*:*"
|
||||
"cpe:2.3:a:mekshq:meks_smart_author_widget:*:*:*:*:*:wordpress:*:*",
|
||||
"cpe:2.3:a:mekshq:smart_author_widget:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"meks-smart-social-widget": [
|
||||
"cpe:2.3:a:mekshq:meks_smart_social_widget:*:*:*:*:*:wordpress:*:*"
|
||||
@@ -14603,6 +14654,9 @@
|
||||
"note-press": [
|
||||
"cpe:2.3:a:datainterlock:note_press:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"notice-faq": [
|
||||
"cpe:2.3:a:notice:notice_faq:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"notices": [
|
||||
"cpe:2.3:a:notices_project:notices:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -15193,6 +15247,9 @@
|
||||
"plausible-analytics": [
|
||||
"cpe:2.3:a:plausible:plausible_analytics:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"play-ht": [
|
||||
"cpe:2.3:a:hammadh:play.ht:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"player": [
|
||||
"cpe:2.3:a:web-dorado:spidervplayer:*:*:*:*:*:wordpress:*:*",
|
||||
"cpe:2.3:a:web-dorado:web-dorado_spider_video_player:*:*:*:*:*:wordpress:*:*"
|
||||
@@ -15455,6 +15512,9 @@
|
||||
"posts-reminder": [
|
||||
"cpe:2.3:a:lucasgarcia:posts_reminder:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"posts-table-filterable": [
|
||||
"cpe:2.3:a:pluginus:tableon_-_wordpress_posts_table_filterable:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"posttabs": [
|
||||
"cpe:2.3:a:posttabs_project:posttabs:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -15850,6 +15910,9 @@
|
||||
"randomtext": [
|
||||
"cpe:2.3:a:random_text_project:random_text:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"rapid-cache": [
|
||||
"cpe:2.3:a:megaoptim:rapid_cache:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"rara-one-click-demo-import": [
|
||||
"cpe:2.3:a:rarathemes:rara_one_click_demo_import:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -16584,6 +16647,9 @@
|
||||
"shiny-buttons": [
|
||||
"cpe:2.3:a:wpeden:shiny_buttons:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"shipengine-shipping-quotes": [
|
||||
"cpe:2.3:a:eniture:shipengine_shipping_quotes:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"shopello": [
|
||||
"cpe:2.3:a:shopello_api_project:shopello_api:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -17149,13 +17215,28 @@
|
||||
"slideshow-se": [
|
||||
"cpe:2.3:a:slideshow_se_project:slideshow_se:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"small-package-quotes-fedex-edition": [
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:fedex:wordpress:*:*"
|
||||
],
|
||||
"small-package-quotes-purolator-edition": [
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:purolator:wordpress:*:*"
|
||||
],
|
||||
"small-package-quotes-unishippers-edition": [
|
||||
"cpe:2.3:a:eniture:ltl_freight_quotes:*:*:*:*:unishippers:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:unishippers:wordpress:*:*"
|
||||
],
|
||||
"small-package-quotes-ups-edition": [
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:ups:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:usps:wordpress:*:*",
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:wee:wordpress:*:*",
|
||||
"cpe:2.3:a:enituretechnology:small_package_quotes:*:*:*:*:ups:wordpress:*:*"
|
||||
],
|
||||
"small-package-quotes-usps-edition": [
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:usps:wordpress:*:*"
|
||||
],
|
||||
"small-package-quotes-wwe-edition": [
|
||||
"cpe:2.3:a:eniture:small_package_quotes:*:*:*:*:wee:wordpress:*:*"
|
||||
],
|
||||
"smart-app-banner": [
|
||||
"cpe:2.3:a:wandlesoftware:smart_app_banner:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -18087,6 +18168,9 @@
|
||||
"tourfic": [
|
||||
"cpe:2.3:a:themefic:tourfic:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"tourmaster": [
|
||||
"cpe:2.3:a:goodlayers:tour_master:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"tournamatch": [
|
||||
"cpe:2.3:a:tournamatch:tournamatch:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -19525,6 +19609,9 @@
|
||||
"wp-backgrounds-lite": [
|
||||
"cpe:2.3:a:inoplugs:wp-backgrounds_lite:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"wp-backitup": [
|
||||
"cpe:2.3:a:wpbackitup:backup_and_restore_wordpress:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"wp-baidu-submit": [
|
||||
"cpe:2.3:a:wp_baidu_submit_project:wp_baidu_submit:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
@@ -21677,6 +21764,9 @@
|
||||
"posterity": [
|
||||
"cpe:2.3:a:sktthemes:posterity:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"pressmart": [
|
||||
"cpe:2.3:a:presslayouts:pressmart:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
"regina-lite": [
|
||||
"cpe:2.3:a:machothemes:regina_lite:*:*:*:*:*:wordpress:*:*"
|
||||
],
|
||||
|
||||
@@ -1,15 +1,18 @@
|
||||
package java
|
||||
|
||||
import (
|
||||
"cmp"
|
||||
"context"
|
||||
"crypto"
|
||||
"fmt"
|
||||
"io"
|
||||
"iter"
|
||||
"os"
|
||||
"path"
|
||||
"slices"
|
||||
"strings"
|
||||
|
||||
"github.com/scylladb/go-set/strset"
|
||||
"golang.org/x/exp/maps"
|
||||
|
||||
"github.com/anchore/syft/internal"
|
||||
@@ -391,20 +394,32 @@ func (j *archiveParser) discoverMainPackageFromPomInfo(ctx context.Context) (gro
|
||||
projects, _ := pomProjectByParentPath(j.archivePath, j.location, j.fileManifest.GlobMatch(false, pomXMLGlob))
|
||||
|
||||
// map of all the artifacts in the pom properties, in order to chek exact match with the filename
|
||||
artifactsMap := make(map[string]bool)
|
||||
artifactsMap := strset.New()
|
||||
for _, propertiesObj := range properties {
|
||||
artifactsMap[propertiesObj.ArtifactID] = true
|
||||
artifactsMap.Add(propertiesObj.ArtifactID)
|
||||
}
|
||||
|
||||
parentPaths := maps.Keys(properties)
|
||||
slices.Sort(parentPaths)
|
||||
for _, parentPath := range parentPaths {
|
||||
propertiesObj := properties[parentPath]
|
||||
for parentPath, propertiesObj := range sortedIter(properties) {
|
||||
// the logic for selecting the best name is as follows:
|
||||
// if we find an artifact id AND group id which are both contained in the filename
|
||||
// OR if we have an artifact id that exactly matches the filename, prefer this
|
||||
// OTHERWISE track the first matching pom properties with a pom.xml
|
||||
// FINALLY return the first matching pom properties
|
||||
if artifactIDMatchesFilename(propertiesObj.ArtifactID, j.fileInfo.name, artifactsMap) {
|
||||
pomProperties = propertiesObj
|
||||
if pomProperties.ArtifactID == "" { // keep the first match, or overwrite if we find more specific entries
|
||||
pomProperties = propertiesObj
|
||||
}
|
||||
if proj, exists := projects[parentPath]; exists {
|
||||
parsedPom = proj
|
||||
break
|
||||
if parsedPom == nil { // keep the first matching artifact if we don't find an exact match or groupid + artfiact id match
|
||||
pomProperties = propertiesObj // set this, as it may not be the first entry found
|
||||
parsedPom = proj
|
||||
}
|
||||
// if artifact ID is the entire filename or BOTH artifactID and groupID are contained in the artifact, prefer this match
|
||||
if strings.Contains(j.fileInfo.name, propertiesObj.GroupID) || j.fileInfo.name == propertiesObj.ArtifactID {
|
||||
pomProperties = propertiesObj // this is an exact match, use it
|
||||
parsedPom = proj
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -429,12 +444,13 @@ func (j *archiveParser) discoverMainPackageFromPomInfo(ctx context.Context) (gro
|
||||
return group, name, version, parsedPom
|
||||
}
|
||||
|
||||
func artifactIDMatchesFilename(artifactID, fileName string, artifactsMap map[string]bool) bool {
|
||||
// artifactIDMatchesFilename returns true if one starts with the other
|
||||
func artifactIDMatchesFilename(artifactID, fileName string, artifactsMap *strset.Set) bool {
|
||||
if artifactID == "" || fileName == "" {
|
||||
return false
|
||||
}
|
||||
// Ensure true is returned when filename matches the artifact ID, prevent random retrieval by checking prefix and suffix
|
||||
if _, exists := artifactsMap[fileName]; exists {
|
||||
if artifactsMap.Has(fileName) {
|
||||
return artifactID == fileName
|
||||
}
|
||||
// Use fallback check with suffix and prefix if no POM properties file matches the exact artifact name
|
||||
@@ -464,7 +480,7 @@ func (j *archiveParser) discoverPkgsFromAllMavenFiles(ctx context.Context, paren
|
||||
return nil, err
|
||||
}
|
||||
|
||||
for parentPath, propertiesObj := range properties {
|
||||
for parentPath, propertiesObj := range sortedIter(properties) {
|
||||
var parsedPom *parsedPomProject
|
||||
if proj, exists := projects[parentPath]; exists {
|
||||
parsedPom = proj
|
||||
@@ -546,7 +562,7 @@ func discoverPkgsFromOpeners(ctx context.Context, location file.Location, opener
|
||||
var pkgs []pkg.Package
|
||||
var relationships []artifact.Relationship
|
||||
|
||||
for pathWithinArchive, archiveOpener := range openers {
|
||||
for pathWithinArchive, archiveOpener := range sortedIter(openers) {
|
||||
nestedPkgs, nestedRelationships, err := discoverPkgsFromOpener(ctx, location, pathWithinArchive, archiveOpener, cfg, parentPkg)
|
||||
if err != nil {
|
||||
log.WithFields("location", location.Path(), "error", err).Debug("unable to discover java packages from opener")
|
||||
@@ -604,7 +620,7 @@ func pomPropertiesByParentPath(archivePath string, location file.Location, extra
|
||||
}
|
||||
|
||||
propertiesByParentPath := make(map[string]pkg.JavaPomProperties)
|
||||
for filePath, fileContents := range contentsOfMavenPropertiesFiles {
|
||||
for filePath, fileContents := range sortedIter(contentsOfMavenPropertiesFiles) {
|
||||
pomProperties, err := parsePomProperties(filePath, strings.NewReader(fileContents))
|
||||
if err != nil {
|
||||
log.WithFields("contents-path", filePath, "location", location.Path(), "error", err).Debug("failed to parse pom.properties")
|
||||
@@ -633,7 +649,7 @@ func pomProjectByParentPath(archivePath string, location file.Location, extractP
|
||||
}
|
||||
|
||||
projectByParentPath := make(map[string]*parsedPomProject)
|
||||
for filePath, fileContents := range contentsOfMavenProjectFiles {
|
||||
for filePath, fileContents := range sortedIter(contentsOfMavenProjectFiles) {
|
||||
// TODO: when we support locations of paths within archives we should start passing the specific pom.xml location object instead of the top jar
|
||||
pom, err := maven.ParsePomXML(strings.NewReader(fileContents))
|
||||
if err != nil {
|
||||
@@ -784,3 +800,15 @@ func updateParentPackage(p pkg.Package, parentPkg *pkg.Package) {
|
||||
parentPkg.Metadata = parentMetadata
|
||||
}
|
||||
}
|
||||
|
||||
func sortedIter[K cmp.Ordered, V any](values map[K]V) iter.Seq2[K, V] {
|
||||
return func(yield func(K, V) bool) {
|
||||
keys := maps.Keys(values)
|
||||
slices.Sort(keys)
|
||||
for _, key := range keys {
|
||||
if !yield(key, values[key]) {
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1086,7 +1086,7 @@ func Test_artifactIDMatchesFilename(t *testing.T) {
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
assert.Equal(t, tt.want, artifactIDMatchesFilename(tt.artifactID, tt.fileName, nil))
|
||||
assert.Equal(t, tt.want, artifactIDMatchesFilename(tt.artifactID, tt.fileName, strset.New()))
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -1382,6 +1382,10 @@ func Test_deterministicMatchingPomProperties(t *testing.T) {
|
||||
fixture: "multiple-matching-2.11.5",
|
||||
expected: maven.NewID("org.multiple", "multiple-matching-1", "2.11.5"),
|
||||
},
|
||||
{
|
||||
fixture: "org.multiple-thename",
|
||||
expected: maven.NewID("org.multiple", "thename", "10.11.12"),
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range tests {
|
||||
|
||||
@@ -12,6 +12,7 @@ OPENSAML_CORE = opensaml-core-3.4.6
|
||||
API_ALL_SOURCES = api-all-2.0.0-sources
|
||||
SPRING_INSTRUMENTATION = spring-instrumentation-4.3.0-1.0
|
||||
MULTIPLE_MATCHING = multiple-matching-2.11.5
|
||||
ORG_MULTIPLE_THENAME = org.multiple-thename
|
||||
|
||||
|
||||
.DEFAULT_GOAL := fixtures
|
||||
@@ -48,7 +49,11 @@ $(CACHE_DIR)/$(MULTIPLE_MATCHING).jar:
|
||||
mkdir -p $(CACHE_DIR)
|
||||
cd $(MULTIPLE_MATCHING) && zip -r $(CACHE_PATH)/$(MULTIPLE_MATCHING).jar .
|
||||
|
||||
# Jenkins plugins typically do not have the version included in the archive name,
|
||||
$(CACHE_DIR)/$(ORG_MULTIPLE_THENAME).jar:
|
||||
mkdir -p $(CACHE_DIR)
|
||||
cd $(ORG_MULTIPLE_THENAME) && zip -r $(CACHE_PATH)/$(ORG_MULTIPLE_THENAME).jar .
|
||||
|
||||
# Jenkins plugins typically do not have the version included in the archive name,
|
||||
# so it is important to not include it in the generated test fixture
|
||||
$(CACHE_DIR)/gradle.hpi:
|
||||
mkdir -p $(CACHE_DIR)
|
||||
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
Manifest-Version: 1.0
|
||||
Created-By: Multi
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
version=10.11.12
|
||||
groupId=com.multiple
|
||||
artifactId=thename
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<groupId>com.multiple</groupId>
|
||||
<artifactId>thename</artifactId>
|
||||
<version>10.11.12</version>
|
||||
</project>
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
version=10.11.12
|
||||
groupId=org.multiple
|
||||
artifactId=thename
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<groupId>org.multiple</groupId>
|
||||
<artifactId>thename</artifactId>
|
||||
<version>10.11.12</version>
|
||||
</project>
|
||||
+21
-2
@@ -14,6 +14,7 @@ import (
|
||||
|
||||
"github.com/anchore/syft/internal/licenses"
|
||||
"github.com/anchore/syft/internal/log"
|
||||
"github.com/anchore/syft/internal/spdxlicense"
|
||||
"github.com/anchore/syft/syft/artifact"
|
||||
"github.com/anchore/syft/syft/file"
|
||||
"github.com/anchore/syft/syft/license"
|
||||
@@ -132,6 +133,13 @@ func stripUnwantedCharacters(rawURL string) (string, error) {
|
||||
}
|
||||
|
||||
func NewLicenseFromFieldsWithContext(ctx context.Context, value, url string, location *file.Location) License {
|
||||
// If value is empty but URL is provided, try to enrich from SPDX database
|
||||
if value == "" && url != "" {
|
||||
if info, found := spdxlicense.LicenseByURL(url); found {
|
||||
value = info.ID
|
||||
}
|
||||
}
|
||||
|
||||
lics := newLicenseBuilder().WithValues(value).WithURLs(url).WithOptionalLocation(location).Build(ctx).ToSlice()
|
||||
if len(lics) > 0 {
|
||||
return lics[0]
|
||||
@@ -294,11 +302,22 @@ func (b *licenseBuilder) Build(ctx context.Context) LicenseSet {
|
||||
|
||||
if set.Empty() && len(b.urls) > 0 {
|
||||
// if we have no values or contents, but we do have URLs, let's make a license with the URLs
|
||||
set.Add(License{
|
||||
// try to enrich the license by looking up the URL in the SPDX database
|
||||
license := License{
|
||||
Type: b.tp,
|
||||
URLs: b.urls,
|
||||
Locations: locations,
|
||||
})
|
||||
}
|
||||
|
||||
// attempt to fill in missing license information from the first URL
|
||||
if len(b.urls) > 0 {
|
||||
if info, found := spdxlicense.LicenseByURL(b.urls[0]); found {
|
||||
license.Value = info.ID
|
||||
license.SPDXExpression = info.ID
|
||||
}
|
||||
}
|
||||
|
||||
set.Add(license)
|
||||
}
|
||||
|
||||
return set
|
||||
|
||||
@@ -0,0 +1,180 @@
|
||||
package pkg
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestNewLicenseFromFieldsWithContext_URLEnrichment(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
value string
|
||||
url string
|
||||
wantValue string
|
||||
wantHasURL bool
|
||||
}{
|
||||
{
|
||||
name: "Empty value with MIT URL should enrich",
|
||||
value: "",
|
||||
url: "http://opensource.org/licenses/MIT",
|
||||
wantValue: "MIT",
|
||||
wantHasURL: true,
|
||||
},
|
||||
{
|
||||
name: "Empty value with Apache URL should enrich",
|
||||
value: "",
|
||||
url: "https://www.apache.org/licenses/LICENSE-2.0",
|
||||
wantValue: "Apache-2.0",
|
||||
wantHasURL: true,
|
||||
},
|
||||
{
|
||||
name: "Non-empty value should not be overridden",
|
||||
value: "Custom-License",
|
||||
url: "http://opensource.org/licenses/MIT",
|
||||
wantValue: "Custom-License",
|
||||
wantHasURL: true,
|
||||
},
|
||||
{
|
||||
name: "Unknown URL should not enrich",
|
||||
value: "",
|
||||
url: "https://example.com/unknown-license",
|
||||
wantValue: "",
|
||||
wantHasURL: true,
|
||||
},
|
||||
{
|
||||
name: "Empty value and empty URL",
|
||||
value: "",
|
||||
url: "",
|
||||
wantValue: "",
|
||||
wantHasURL: false,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
license := NewLicenseFromFieldsWithContext(ctx, tt.value, tt.url, nil)
|
||||
|
||||
if license.Value != tt.wantValue {
|
||||
t.Errorf("NewLicenseFromFieldsWithContext() Value = %v, want %v", license.Value, tt.wantValue)
|
||||
}
|
||||
|
||||
hasURL := len(license.URLs) > 0
|
||||
if hasURL != tt.wantHasURL {
|
||||
t.Errorf("NewLicenseFromFieldsWithContext() has URL = %v, want %v", hasURL, tt.wantHasURL)
|
||||
}
|
||||
|
||||
if tt.wantHasURL && tt.url != "" && license.URLs[0] != tt.url {
|
||||
t.Errorf("NewLicenseFromFieldsWithContext() URL = %v, want %v", license.URLs[0], tt.url)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestLicenseBuilder_URLOnlyEnrichment(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
urls []string
|
||||
wantValue string
|
||||
wantSPDX string
|
||||
wantHasURL bool
|
||||
}{
|
||||
{
|
||||
name: "MIT URL only should enrich",
|
||||
urls: []string{"http://opensource.org/licenses/MIT"},
|
||||
wantValue: "MIT",
|
||||
wantSPDX: "MIT",
|
||||
wantHasURL: true,
|
||||
},
|
||||
{
|
||||
name: "Apache URL only should enrich",
|
||||
urls: []string{"https://www.apache.org/licenses/LICENSE-2.0"},
|
||||
wantValue: "Apache-2.0",
|
||||
wantSPDX: "Apache-2.0",
|
||||
wantHasURL: true,
|
||||
},
|
||||
{
|
||||
name: "Multiple URLs should use first",
|
||||
urls: []string{"http://opensource.org/licenses/MIT", "https://example.com/other"},
|
||||
wantValue: "MIT",
|
||||
wantSPDX: "MIT",
|
||||
wantHasURL: true,
|
||||
},
|
||||
{
|
||||
name: "Unknown URL should not enrich",
|
||||
urls: []string{"https://example.com/unknown-license"},
|
||||
wantValue: "",
|
||||
wantSPDX: "",
|
||||
wantHasURL: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
builder := newLicenseBuilder().WithURLs(tt.urls...)
|
||||
licenses := builder.Build(ctx).ToSlice()
|
||||
|
||||
if len(licenses) == 0 {
|
||||
t.Fatal("Expected at least one license")
|
||||
}
|
||||
|
||||
license := licenses[0]
|
||||
|
||||
if license.Value != tt.wantValue {
|
||||
t.Errorf("License Value = %v, want %v", license.Value, tt.wantValue)
|
||||
}
|
||||
|
||||
if license.SPDXExpression != tt.wantSPDX {
|
||||
t.Errorf("License SPDXExpression = %v, want %v", license.SPDXExpression, tt.wantSPDX)
|
||||
}
|
||||
|
||||
hasURL := len(license.URLs) > 0
|
||||
if hasURL != tt.wantHasURL {
|
||||
t.Errorf("License has URL = %v, want %v", hasURL, tt.wantHasURL)
|
||||
}
|
||||
|
||||
if tt.wantHasURL && len(tt.urls) > 0 {
|
||||
if len(license.URLs) != len(tt.urls) {
|
||||
t.Errorf("License URL count = %v, want %v", len(license.URLs), len(tt.urls))
|
||||
}
|
||||
if license.URLs[0] != tt.urls[0] {
|
||||
t.Errorf("License first URL = %v, want %v", license.URLs[0], tt.urls[0])
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewLicenseFromURLsWithContext_URLEnrichment(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
value string
|
||||
urls []string
|
||||
wantValue string
|
||||
}{
|
||||
{
|
||||
name: "Empty value with MIT URL should enrich via builder",
|
||||
value: "",
|
||||
urls: []string{"http://opensource.org/licenses/MIT"},
|
||||
wantValue: "MIT",
|
||||
},
|
||||
{
|
||||
name: "Non-empty value should not be changed",
|
||||
value: "Custom-License",
|
||||
urls: []string{"http://opensource.org/licenses/MIT"},
|
||||
wantValue: "Custom-License",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
license := NewLicenseFromURLsWithContext(ctx, tt.value, tt.urls...)
|
||||
|
||||
if license.Value != tt.wantValue {
|
||||
t.Errorf("NewLicenseFromURLsWithContext() Value = %v, want %v", license.Value, tt.wantValue)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -1,8 +1,9 @@
|
||||
package source
|
||||
|
||||
type Alias struct {
|
||||
Name string `json:"name" yaml:"name" mapstructure:"name"`
|
||||
Version string `json:"version" yaml:"version" mapstructure:"version"`
|
||||
Name string `json:"name" yaml:"name" mapstructure:"name"`
|
||||
Version string `json:"version" yaml:"version" mapstructure:"version"`
|
||||
Supplier string `json:"supplier" yaml:"supplier" mapstructure:"supplier"`
|
||||
}
|
||||
|
||||
func (a *Alias) IsEmpty() bool {
|
||||
|
||||
@@ -5,5 +5,6 @@ type Description struct {
|
||||
ID string `hash:"ignore"` // the id generated from the parent source struct
|
||||
Name string `hash:"ignore"`
|
||||
Version string `hash:"ignore"`
|
||||
Supplier string `hash:"ignore"`
|
||||
Metadata interface{}
|
||||
}
|
||||
|
||||
@@ -112,6 +112,7 @@ func (s directorySource) ID() artifact.ID {
|
||||
func (s directorySource) Describe() source.Description {
|
||||
name := cleanDirPath(s.config.Path, s.config.Base)
|
||||
version := ""
|
||||
supplier := ""
|
||||
if !s.config.Alias.IsEmpty() {
|
||||
a := s.config.Alias
|
||||
if a.Name != "" {
|
||||
@@ -120,11 +121,15 @@ func (s directorySource) Describe() source.Description {
|
||||
if a.Version != "" {
|
||||
version = a.Version
|
||||
}
|
||||
if a.Supplier != "" {
|
||||
supplier = a.Supplier
|
||||
}
|
||||
}
|
||||
return source.Description{
|
||||
ID: string(s.id),
|
||||
Name: name,
|
||||
Version: version,
|
||||
ID: string(s.id),
|
||||
Name: name,
|
||||
Version: version,
|
||||
Supplier: supplier,
|
||||
Metadata: source.DirectoryMetadata{
|
||||
Path: s.config.Path,
|
||||
Base: s.config.Base,
|
||||
|
||||
@@ -475,12 +475,13 @@ func Test_DirectorySource_ID(t *testing.T) {
|
||||
wantErr: require.Error,
|
||||
},
|
||||
{
|
||||
name: "to dir with name and version",
|
||||
name: "to dir with name and version and supplier",
|
||||
cfg: Config{
|
||||
Path: "./test-fixtures",
|
||||
Alias: source.Alias{
|
||||
Name: "name-me-that!",
|
||||
Version: "version-me-this!",
|
||||
Name: "name-me-that!",
|
||||
Version: "version-me-this!",
|
||||
Supplier: "some-supplier",
|
||||
},
|
||||
},
|
||||
want: artifact.ID("51a5f2a1536cf4b5220d4247814b07eec5862ab0547050f90e9ae216548ded7e"),
|
||||
@@ -490,8 +491,9 @@ func Test_DirectorySource_ID(t *testing.T) {
|
||||
cfg: Config{
|
||||
Path: "./test-fixtures/image-simple",
|
||||
Alias: source.Alias{
|
||||
Name: "name-me-that!",
|
||||
Version: "version-me-this!",
|
||||
Name: "name-me-that!",
|
||||
Version: "version-me-this!",
|
||||
Supplier: "some-supplier",
|
||||
},
|
||||
},
|
||||
// note: this must match the previous value because the alias should trump the path info
|
||||
|
||||
@@ -123,6 +123,7 @@ func (s fileSource) ID() artifact.ID {
|
||||
func (s fileSource) Describe() source.Description {
|
||||
name := path.Base(s.config.Path)
|
||||
version := s.digestForVersion
|
||||
supplier := ""
|
||||
if !s.config.Alias.IsEmpty() {
|
||||
a := s.config.Alias
|
||||
if a.Name != "" {
|
||||
@@ -132,11 +133,16 @@ func (s fileSource) Describe() source.Description {
|
||||
if a.Version != "" {
|
||||
version = a.Version
|
||||
}
|
||||
|
||||
if a.Supplier != "" {
|
||||
supplier = a.Supplier
|
||||
}
|
||||
}
|
||||
return source.Description{
|
||||
ID: string(s.id),
|
||||
Name: name,
|
||||
Version: version,
|
||||
ID: string(s.id),
|
||||
Name: name,
|
||||
Version: version,
|
||||
Supplier: supplier,
|
||||
Metadata: source.FileMetadata{
|
||||
Path: s.config.Path,
|
||||
Digests: s.digests,
|
||||
|
||||
@@ -51,6 +51,7 @@ func (s stereoscopeImageSource) Describe() source.Description {
|
||||
a := s.config.Alias
|
||||
|
||||
name := a.Name
|
||||
supplier := a.Supplier
|
||||
nameIfUnset := func(n string) {
|
||||
if name != "" {
|
||||
return
|
||||
@@ -90,6 +91,7 @@ func (s stereoscopeImageSource) Describe() source.Description {
|
||||
ID: string(s.id),
|
||||
Name: name,
|
||||
Version: version,
|
||||
Supplier: supplier,
|
||||
Metadata: s.metadata,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -71,6 +71,21 @@ func TestPackagesCmdFlags(t *testing.T) {
|
||||
assertSuccessfulReturnCode,
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "source flags override bom metadata",
|
||||
args: []string{
|
||||
"scan",
|
||||
"--source-name", "custom-name",
|
||||
"--source-version", "custom-version",
|
||||
"--source-supplier", "custom-supplier",
|
||||
"-o", "json", coverageImage},
|
||||
assertions: []traitAssertion{
|
||||
assertInOutput("custom-name"),
|
||||
assertInOutput("custom-version"),
|
||||
assertInOutput("custom-supplier"),
|
||||
assertSuccessfulReturnCode,
|
||||
},
|
||||
},
|
||||
// I haven't been able to reproduce locally yet, but in CI this has proven to be unstable:
|
||||
// For the same commit:
|
||||
// pass: https://github.com/anchore/syft/runs/4611344142?check_suite_focus=true
|
||||
|
||||
Reference in New Issue
Block a user