fix(sbom): don't overwrite srcEpoch when decoding SBOM files (#6866)

aquasecurity · Jun 7, 2024 · 743c495 · 743c495
1 parent 6bfda76
commit 743c495
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pkg/sbom/io/decode.go b/pkg/sbom/io/decode.go
@@ -271,6 +271,11 @@ func (m *Decoder) fillSrcPkg(c *core.Component, pkg *ftypes.Package) {
 	}
 	m.parseSrcVersion(pkg, c.SrcVersion)
 
+	// Source info was added from component or properties
+	if pkg.SrcName != "" && pkg.SrcVersion != "" {
+		return
+	}
+
 	// Fill source package information for components in third-party SBOMs .
 	if pkg.SrcName == "" {
 		pkg.SrcName = pkg.Name