Alex Goodman 07c2c816c6 fix: keep embedded SBOM relationships from adding files to the scan ...

The bitnami and `sbom` catalogers decode SBOMs found in the scanned image and kept the relationships from them. The decoder nests a file under another the SBOM says CONTAINS it, and makes a file the root package DESCRIBES the scan root, so an embedded SBOM could inject archive chains or root files that encoders then rebuilt in the output.

- both catalogers now drop relationships with a file endpoint that is nested or at the scan root
- bitnami also keeps only relationships from its own packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

2026-10-29 15:50:03 -04:00

..

cataloger

fix: keep embedded SBOM relationships from adding files to the scan

2026-10-29 15:50:03 -04:00

alpm.go

…

apk_test.go

…

apk.go

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

apple.go

added macOS .app cataloger (#4490)

2026-06-30 10:32:57 -04:00

binary.go

…

bitnami.go

…

cataloger.go

…

cocoapods.go

…

collection_test.go

fix: don't index nested packages under the outer archive path

2026-10-21 11:35:21 -04:00

collection.go

fix: don't index nested packages under the outer archive path

2026-10-21 11:35:21 -04:00

conan.go

…

conda.go

…

dart.go

…

deno.go

feat: deno cataloger #4417 (#4523)

2026-06-23 10:58:22 -04:00

dotnet.go

…

dpkg.go

…

elixir.go

feat(elixir): emit dependency relationships from mix.lock (#4985)

2026-06-29 10:22:38 -04:00

erlang.go

…

evidence.go

…

file_owner.go

…

gguf.go

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

github.go

…

golang.go

feat(golang): add extended-stdlib scope and module patterns for symbol capture (#5154)

2026-08-07 12:44:42 +00:00

hackage.go

…

homebrew.go

…

java_test.go

…

java.go

…

key_value.go

…

language_test.go

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

language.go

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

license_deprecated.go

…

license_set_test.go

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

license_set.go

…

license_test.go

…

license_url_enrichment_test.go

…

license.go

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

linux_kernel.go

…

microsoft.go

…

nix.go

…

npm.go

feat: add support for Bun lockfile (#4625)

2026-06-09 13:22:43 -04:00

ocaml.go

…

package_test.go

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

package.go

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

perl_test.go

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

perl.go

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

php.go

…

portage.go

…

python_test.go

…

python.go

…

r.go

…

rockspec.go

…

rpm_test.go

…

rpm.go

…

ruby.go

…

rust.go

…

safetensors.go

feat: add safe tensor model type to SBOM output (#4844)

2026-07-15 17:14:03 -04:00

snap.go

…

swift.go

…

swipl.go

…

terraform.go

…

type_test.go

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

type.go

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

url.go

…

vcpkg.go

feat: optionally capture golang binary symbols (#4988)

2026-07-13 10:30:23 -04:00

wordpress.go

…