Alex Goodman bf8ded3cf8 build source PURL from metadata and gate it to CycloneDX 1.6+ ...

- the source PURL is built from package metadata instead of editing the binary PURL: only `distro` (plus `epoch` and `rpmmod` for rpm) is carried over, subpath is dropped, and the ref is skipped when the PURL type does not match the metadata ecosystem
- one emission rule for all ecosystems: only when the source name or version differs from the binary, so self-sourced rpm and alpm packages no longer get a redundant ref
- source RPM names must end in `.src.rpm` or `.nosrc.rpm`, and `nosrc` maps to `arch=nosrc`
- `source-distribution` refs are dropped when encoding below spec 1.6, since cyclonedx-go does not downgrade them (CycloneDX/cyclonedx-go#291)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

2026-09-30 12:56:05 -04:00

..

common

fix(spdx): write a name for the root package when the source has none (#5349)

2026-09-29 21:30:52 +00:00

cpes

fix: report scanner errors and raise the line cap in metadata parsers (#5353)

2026-09-29 16:52:58 -04:00

cyclonedxjson

build source PURL from metadata and gate it to CycloneDX 1.6+

2026-09-30 12:56:05 -04:00

cyclonedxxml

Adjust arch qualifier for source PURLs

2026-09-30 12:56:05 -04:00

github

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

internal

build source PURL from metadata and gate it to CycloneDX 1.6+

2026-09-30 12:56:05 -04:00

purls

fix: report scanner errors and raise the line cap in metadata parsers (#5353)

2026-09-29 16:52:58 -04:00

spdxjson

fix(spdx): write a name for the root package when the source has none (#5349)

2026-09-29 21:30:52 +00:00

spdxtagvalue

fix(spdx): write a name for the root package when the source has none (#5349)

2026-09-29 21:30:52 +00:00

syftjson

fix: update steroscope to include OCI platform metadata (#5128)

2026-09-16 01:40:54 +00:00

table

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

template

fix(template): expose sprig date/time functions in Go templates (#4644)

2026-06-29 11:55:51 -04:00

testdata

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

text

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

decoders_collection_test.go

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

decoders_collection.go

feat: Add PURL list input/output format (#3853)

2025-05-12 13:33:24 -04:00

decoders.go

feat(convert): passthrough-exact-format copies matching syft-json input unchanged (#5279)

2026-09-14 14:33:03 -04:00

encoders_collection_test.go

feat: SPDX 3 (#4269)

2026-06-22 10:59:34 -04:00

encoders_collection.go

feat: SPDX 3 (#4269)

2026-06-22 10:59:34 -04:00

encoders_test.go

feat: Add PURL list input/output format (#3853)

2025-05-12 13:33:24 -04:00

encoders.go

feat: Add PURL list input/output format (#3853)

2025-05-12 13:33:24 -04:00

untyped_metadata_test.go

Harden cataloger parsers against truncated input (do not panic) (#5355)

2026-09-29 16:26:42 -04:00