mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 23:16:30 +01:00
Antoni (Tony) Jagodka
a8d4fb845f
The package supplier is optional in SPDX, but fileSource dereferenced it without the nil check containerSource already has, so a valid SPDX 2.3 document whose described package has primaryPackagePurpose FILE and no supplier crashed syft convert and grype sbom: input. A JSON null in files, a package's files or externalRefs (or an SPDX 2.1 package the version converter cannot map) decodes to a nil pointer that the conversion then dereferences. Drop nil entries once at the start of ToSyftModel instead of guarding each loop. Signed-off-by: Tony <tjagodka@gmail.com>
30 lines
1.0 KiB
JSON
30 lines
1.0 KiB
JSON
{
|
|
"spdxVersion": "SPDX-2.3",
|
|
"dataLicense": "CC0-1.0",
|
|
"SPDXID": "SPDXRef-DOCUMENT",
|
|
"name": "app.tar.gz",
|
|
"documentNamespace": "https://example.com/spdx/app-1.0",
|
|
"creationInfo": { "created": "2026-09-24T00:00:00Z", "creators": ["Tool: example-1.0"] },
|
|
"packages": [
|
|
{
|
|
"SPDXID": "SPDXRef-app",
|
|
"name": "app.tar.gz",
|
|
"downloadLocation": "NOASSERTION",
|
|
"filesAnalyzed": false,
|
|
"primaryPackagePurpose": "FILE"
|
|
},
|
|
{
|
|
"SPDXID": "SPDXRef-requests",
|
|
"name": "requests",
|
|
"versionInfo": "2.31.0",
|
|
"downloadLocation": "NOASSERTION",
|
|
"filesAnalyzed": false,
|
|
"externalRefs": [{ "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", "referenceLocator": "pkg:pypi/requests@2.31.0" }]
|
|
}
|
|
],
|
|
"relationships": [
|
|
{ "spdxElementId": "SPDXRef-DOCUMENT", "relationshipType": "DESCRIBES", "relatedSpdxElement": "SPDXRef-app" },
|
|
{ "spdxElementId": "SPDXRef-app", "relationshipType": "CONTAINS", "relatedSpdxElement": "SPDXRef-requests" }
|
|
]
|
|
}
|