mirror of
https://github.com/anchore/syft.git
synced 2026-10-31 14:36:33 +01:00
William Murphy
b7a6d5e946
Syft can get CPEs from several source, including generating them based on package data, finding them in the NVD CPE dictionary, or finding them declared in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of SBOMs can reason about how trustworthy they are. Signed-off-by: Will Murphy <will.murphy@anchore.com>
47 lines
980 B
Go
47 lines
980 B
Go
package helpers
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"github.com/anchore/syft/syft/cpe"
|
|
"github.com/anchore/syft/syft/pkg"
|
|
)
|
|
|
|
func Test_ExternalRefs(t *testing.T) {
|
|
testCPE := cpe.Must("cpe:2.3:a:name:name:3.2:*:*:*:*:*:*:*", cpe.Source(""))
|
|
tests := []struct {
|
|
name string
|
|
input pkg.Package
|
|
expected []ExternalRef
|
|
}{
|
|
{
|
|
name: "cpe + purl",
|
|
input: pkg.Package{
|
|
CPEs: []cpe.CPE{
|
|
testCPE,
|
|
},
|
|
PURL: "a-purl",
|
|
},
|
|
expected: []ExternalRef{
|
|
{
|
|
ReferenceCategory: SecurityReferenceCategory,
|
|
ReferenceLocator: testCPE.Attributes.String(),
|
|
ReferenceType: Cpe23ExternalRefType,
|
|
},
|
|
{
|
|
ReferenceCategory: PackageManagerReferenceCategory,
|
|
ReferenceLocator: "a-purl",
|
|
ReferenceType: PurlExternalRefType,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
assert.ElementsMatch(t, test.expected, ExternalRefs(test.input))
|
|
})
|
|
}
|
|
}
|