mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 06:56:40 +01:00
William Murphy
b7a6d5e946
Syft can get CPEs from several source, including generating them based on package data, finding them in the NVD CPE dictionary, or finding them declared in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of SBOMs can reason about how trustworthy they are. Signed-off-by: Will Murphy <will.murphy@anchore.com>
40 lines
873 B
Go
40 lines
873 B
Go
package cpe
|
|
|
|
import "sort"
|
|
|
|
type BySourceThenSpecificity []CPE
|
|
|
|
func (b BySourceThenSpecificity) Len() int {
|
|
return len(b)
|
|
}
|
|
|
|
func (b BySourceThenSpecificity) Less(i, j int) bool {
|
|
sourceOrder := map[Source]int{
|
|
NVDDictionaryLookupSource: 1,
|
|
DeclaredSource: 2,
|
|
GeneratedSource: 3,
|
|
}
|
|
|
|
getRank := func(source Source) int {
|
|
if rank, exists := sourceOrder[source]; exists {
|
|
return rank
|
|
}
|
|
return 4 // Sourced we don't know about can't be assigned special priority, so
|
|
// are considered ties.
|
|
}
|
|
iSource := b[i].Source
|
|
jSource := b[j].Source
|
|
rankI, rankJ := getRank(iSource), getRank(jSource)
|
|
if rankI != rankJ {
|
|
return rankI < rankJ
|
|
}
|
|
|
|
return isMoreSpecific(b[i].Attributes, b[j].Attributes)
|
|
}
|
|
|
|
func (b BySourceThenSpecificity) Swap(i, j int) {
|
|
b[i], b[j] = b[j], b[i]
|
|
}
|
|
|
|
var _ sort.Interface = (*BySourceThenSpecificity)(nil)
|