mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 23:16:30 +01:00
Sai Asish YandAlex Goodman
e8abab2e77
* swift: emit canonical purls without .git suffix or repeated name
Reported in anchore/syft#3961: the purl syft emits for Swift packages
parsed out of Package.resolved keeps the repository URLs .git suffix
and then re-appends the package name, producing
pkg:swift/github.com/apple/swift-nio-ssl.git/swift-nio-ssl@2.0.0
NVD / Grype cannot match that purl against the known
swift-nio-ssl@2.0.0 CVE (GHSA-frg3-gpcx-968f), so every Swift SBOM
produced by syft silently loses vulnerability coverage. cdxgen and
the wider purl ecosystem use the shorter form
pkg:swift/github.com/apple/swift-nio-ssl@2.0.0
which Grype does match.
Replace the ad-hoc strings.Replace with swiftNamespaceFromSourceURL,
which trims the common URL schemes, strips the ".git" suffix, and
drops a trailing /<name> segment so the namespace is only the
organisation path (e.g. github.com/apple). Existing test expectations
are updated to the new purl shape.
Fixes #3961
Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* Revert unrelated consul binary classifier changes
The swift purl commit (ff5ffc37) accidentally bundled removal of the
consul GitDescribe and NUL-wrapped version matchers plus the 1.12.9 and
1.7.14 fixtures/test cases. That drops version detection for consul
binaries not carrying the CONSUL_VERSION string. Restore the binary
cataloger to its pre-commit state so this branch is swift-only.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* swift: strip repeated name segment case-insensitively
Package.resolved identities are lowercased while the repo URL path may be
mixed-case (e.g. github.com/Apple/Swift-NIO vs identity swift-nio). The
case-sensitive TrimSuffix left the repo segment in the namespace for such
repos, reintroducing the duplicated-name purl. Compare the trailing segment
with EqualFold and add unit coverage for swiftPackageManagerPackageURL.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
85 lines
2.0 KiB
Go
85 lines
2.0 KiB
Go
package swift
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func Test_swiftPackageManagerPackageURL(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
pkgName string
|
|
version string
|
|
sourceURL string
|
|
want string
|
|
}{
|
|
{
|
|
name: "strips .git suffix and repeated name segment",
|
|
pkgName: "swift-nio-ssl",
|
|
version: "2.0.0",
|
|
sourceURL: "https://github.com/apple/swift-nio-ssl.git",
|
|
want: "pkg:swift/github.com/apple/swift-nio-ssl@2.0.0",
|
|
},
|
|
{
|
|
name: "no .git suffix",
|
|
pkgName: "swift-numerics",
|
|
version: "1.0.2",
|
|
sourceURL: "https://github.com/apple/swift-numerics",
|
|
want: "pkg:swift/github.com/apple/swift-numerics@1.0.2",
|
|
},
|
|
{
|
|
name: "mixed-case repo path with lowercased identity",
|
|
pkgName: "swift-nio",
|
|
version: "2.0.0",
|
|
sourceURL: "https://github.com/Apple/Swift-NIO.git",
|
|
want: "pkg:swift/github.com/Apple/swift-nio@2.0.0",
|
|
},
|
|
{
|
|
name: "ssh scheme",
|
|
pkgName: "swift-nio",
|
|
version: "2.0.0",
|
|
sourceURL: "git+ssh://github.com/apple/swift-nio.git",
|
|
want: "pkg:swift/github.com/apple/swift-nio@2.0.0",
|
|
},
|
|
{
|
|
name: "trailing segment differs from name is preserved",
|
|
pkgName: "nio",
|
|
version: "2.0.0",
|
|
sourceURL: "https://github.com/apple/swift-nio.git",
|
|
want: "pkg:swift/github.com/apple/swift-nio/nio@2.0.0",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert.Equal(t, tt.want, swiftPackageManagerPackageURL(tt.pkgName, tt.version, tt.sourceURL))
|
|
})
|
|
}
|
|
}
|
|
|
|
func Test_cocoaPodsPackageURL(t *testing.T) {
|
|
type args struct {
|
|
name string
|
|
version string
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
want string
|
|
}{
|
|
{
|
|
name: "go case",
|
|
args: args{
|
|
name: "name",
|
|
version: "v0.1.0",
|
|
},
|
|
want: "pkg:cocoapods/name@v0.1.0",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assert.Equal(t, tt.want, cocoaPodsPackageURL(tt.args.name, tt.args.version))
|
|
})
|
|
}
|
|
}
|