mirror of
https://github.com/anchore/syft.git
synced 2025-11-19 17:33:18 +01:00
e2ebc9769f
Adding APK OriginPackage CPE candidates to the child package results in false positives in grype because it can't associate CPE-based findings to the corresponding OriginPackage APK fixes. This reverts changing the `upstream` in the PURL for APK packages as the logic in Grype that uses it expects it to be an APK package name. This also allows refactoring to unexport and move the APK CPE candidate generation logic closer to where CPE generation occurs Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
55 lines
1.2 KiB
Go
55 lines
1.2 KiB
Go
package apkdb
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/anchore/packageurl-go"
|
|
"github.com/anchore/syft/syft/linux"
|
|
"github.com/anchore/syft/syft/pkg"
|
|
"github.com/anchore/syft/syft/source"
|
|
)
|
|
|
|
func newPackage(d pkg.ApkMetadata, release *linux.Release, locations ...source.Location) pkg.Package {
|
|
p := pkg.Package{
|
|
Name: d.Package,
|
|
Version: d.Version,
|
|
Locations: source.NewLocationSet(locations...),
|
|
Licenses: strings.Split(d.License, " "),
|
|
PURL: packageURL(d, release),
|
|
Type: pkg.ApkPkg,
|
|
MetadataType: pkg.ApkMetadataType,
|
|
Metadata: d,
|
|
}
|
|
|
|
p.SetID()
|
|
|
|
return p
|
|
}
|
|
|
|
// packageURL returns the PURL for the specific Alpine package (see https://github.com/package-url/purl-spec)
|
|
func packageURL(m pkg.ApkMetadata, distro *linux.Release) string {
|
|
if distro == nil {
|
|
return ""
|
|
}
|
|
|
|
qualifiers := map[string]string{
|
|
pkg.PURLQualifierArch: m.Architecture,
|
|
}
|
|
|
|
if m.OriginPackage != m.Package {
|
|
qualifiers[pkg.PURLQualifierUpstream] = m.OriginPackage
|
|
}
|
|
|
|
return packageurl.NewPackageURL(
|
|
packageurl.TypeAlpine,
|
|
strings.ToLower(distro.ID),
|
|
m.Package,
|
|
m.Version,
|
|
pkg.PURLQualifiers(
|
|
qualifiers,
|
|
distro,
|
|
),
|
|
"",
|
|
).ToString()
|
|
}
|