William Murphy b7a6d5e946

feat: Record where CPEs come from (#2552) ...

Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

2024-02-02 16:17:52 +00:00

..

syft

feat: Record where CPEs come from (#2552)

2024-02-02 16:17:52 +00:00