Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(sbom): export bom-ref when converting a package to a component #7340

Merged
merged 18 commits into from
Sep 19, 2024
Merged

fix(sbom): export bom-ref when converting a package to a component #7340

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
73a0018
fix(sbom): export bom-ref
afdesk Aug 14, 2024
f22f6b4
fix tests
afdesk Aug 14, 2024
0eebb2a
remove file path
Aug 15, 2024
46e10ac
add test case
afdesk Aug 17, 2024
5cb120b
fix: update test data
afdesk Aug 21, 2024
4e42d28
test: keep the same uid
afdesk Aug 29, 2024
61486f3
fix: keep existing BOM-ref
afdesk Aug 30, 2024
6067d5f
add: a check
afdesk Aug 30, 2024
0a5090f
refactor: look for SBOM ref only for Os and App layers
afdesk Aug 30, 2024
eaaf98b
refactor
afdesk Aug 30, 2024
418100c
refactor: reuse the parsed SBOM
knqyf263 Sep 13, 2024
0bb6387
test: add appropriate parsed BOMs
knqyf263 Sep 13, 2024
8b33309
fix: linter error
knqyf263 Sep 13, 2024
67961d7
refactor: rename AddVulnerabilities to SetVulnerabilities
knqyf263 Sep 16, 2024
13b0ff4
Revert "refactor: rename AddVulnerabilities to SetVulnerabilities"
knqyf263 Sep 18, 2024
e67a91e
Revert "fix: linter error"
knqyf263 Sep 18, 2024
28c45d8
Revert "test: add appropriate parsed BOMs"
knqyf263 Sep 18, 2024
f4478c0
Revert "refactor: reuse the parsed SBOM"
knqyf263 Sep 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions pkg/sbom/cyclonedx/marshal_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1557,7 +1557,7 @@ func TestMarshaler_MarshalReport(t *testing.T) {
},
Components: &[]cdx.Component{
{
BOMRef: "pkg:maven/com.fasterxml.jackson.core/[email protected]",
BOMRef: "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=jackson-databind-2.13.4.1.jar",
Type: cdx.ComponentTypeLibrary,
Group: "com.fasterxml.jackson.core",
Name: "jackson-databind",
Expand Down Expand Up @@ -1607,7 +1607,7 @@ func TestMarshaler_MarshalReport(t *testing.T) {
Updated: "2022-12-20T10:15:00+00:00",
Affects: &[]cdx.Affects{
{
Ref: "pkg:maven/com.fasterxml.jackson.core/[email protected]",
Ref: "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=jackson-databind-2.13.4.1.jar",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't include file paths in PURL anymore. If it remains somewhere, it should be deleted.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, I'm removing it

Range: &[]cdx.AffectedVersions{
{
Version: "2.13.4.1",
Expand All @@ -1622,11 +1622,11 @@ func TestMarshaler_MarshalReport(t *testing.T) {
{
Ref: "aff65b54-6009-4c32-968d-748949ef46e8",
Dependencies: &[]string{
"pkg:maven/com.fasterxml.jackson.core/[email protected]",
"pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=jackson-databind-2.13.4.1.jar",
},
},
{
Ref: "pkg:maven/com.fasterxml.jackson.core/[email protected]",
Ref: "pkg:maven/com.fasterxml.jackson.core/[email protected]?file_path=jackson-databind-2.13.4.1.jar",
Dependencies: lo.ToPtr([]string{}),
},
},
Expand Down
5 changes: 3 additions & 2 deletions pkg/sbom/io/encode.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,8 +377,9 @@ func (*Encoder) component(result types.Result, pkg ftypes.Package) *core.Compone
SrcVersion: utils.FormatSrcVersion(pkg),
SrcFile: srcFile,
PkgIdentifier: ftypes.PkgIdentifier{
UID: pkg.Identifier.UID,
PURL: pkg.Identifier.PURL,
UID: pkg.Identifier.UID,
PURL: pkg.Identifier.PURL,
BOMRef: pkg.Identifier.BOMRef,
},
Supplier: pkg.Maintainer,
Licenses: pkg.Licenses,
Expand Down