fix(sbom): don't overwrite srcEpoch when decoding SBOM files (#6866)

aquasecurity · Jun 7, 2024 · 04af59c · 04af59c
1 parent bb26445
commit 04af59c
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pkg/sbom/io/decode.go b/pkg/sbom/io/decode.go
@@ -271,6 +271,11 @@ func (m *Decoder) fillSrcPkg(c *core.Component, pkg *ftypes.Package) {
 	}
 	m.parseSrcVersion(pkg, c.SrcVersion)
 
+	// Source info was added from component or properties
+	if pkg.SrcName != "" && pkg.SrcVersion != "" {
+		return
+	}
+
 	// Fill source package information for components in third-party SBOMs .
 	if pkg.SrcName == "" {
 		pkg.SrcName = pkg.Name