add spdx parser #108
add spdx parser #108
Conversation
pxp928
force-pushed
the
spdx-parser
branch
5 times, most recently
from
1e30019
to
2eed0a7
Compare
|
Ready for review! |
Signed-off-by: pxp928 <parth.psu@gmail.com>
Signed-off-by: pxp928 <parth.psu@gmail.com>
Signed-off-by: pxp928 <parth.psu@gmail.com>
Signed-off-by: pxp928 <parth.psu@gmail.com>
Signed-off-by: pxp928 <parth.psu@gmail.com>
pxp928
force-pushed
the
spdx-parser
branch
3 times, most recently
from
c5cab07
to
79f04e9
Compare
Signed-off-by: pxp928 <parth.psu@gmail.com>
| } | ||
|
|
||
| func parseSpdxBlob(p []byte) (*v2_2.Document, error) { | ||
| reader := bytes.NewReader(p) |
There was a problem hiding this comment.
no close defined for the reader.
| j := 0 | ||
| e := false | ||
| for j < n && !e { | ||
| if slice1[i].Type() == "DependsOn" && slice2[j].Type() == "DependsOn" { |
There was a problem hiding this comment.
i think you can just do deep equal here?
There was a problem hiding this comment.
it kept randomly failing on the order of the elements in the slice. Even if they are equal.
Signed-off-by: pxp928 <parth.psu@gmail.com>
| for _, packNode := range foundPackNodes { | ||
| createdEdge, err := getEdge(packNode, rel.Relationship, relatedPackNodes, relatedFileNodes) | ||
| if err != nil { | ||
| logger.Errorf("error generating spdx edge %v", err) |
There was a problem hiding this comment.
wonder if CreateEdge should return error... a discussion for a longer term, don't think we need to mind for now,
| topPackage.Purl = "pkg:oci/" + splitImage[2] + "?repository_url=" + splitImage[0] + "/" + splitImage[1] | ||
| topPackage.Name = s.spdxDoc.DocumentName | ||
| s.packages[string(s.spdxDoc.SPDXIdentifier)] = append(s.packages[string(s.spdxDoc.SPDXIdentifier)], topPackage) | ||
| } |
There was a problem hiding this comment.
should we err if len(splitImae) is not 3? when would this happen?
There was a problem hiding this comment.
so this is a temporary fix until the upstream SPDX issue is resolved. This is a work around to create the node ourself based on the name of the image
| Purl: "pkg:alpine/alpine-baselayout@3.2.0-r22?arch=x86_64&upstream=alpine-baselayout&distro=alpine-3.16.2", | ||
| CPEs: []string{ | ||
| "cpe:2.3:a:alpine-baselayout:alpine-baselayout:3.2.0-r22:*:*:*:*:*:*:*", | ||
| "cpe:2.3:a:alpine-baselayout:alpine_baselayout:3.2.0-r22:*:*:*:*:*:*:*", |
There was a problem hiding this comment.
Does it matter this is the same CPE twice?
There was a problem hiding this comment.
this is what came out of the syft. Seems like a bug that needs to be fixed upstream?
Signed-off-by: pxp928 parth.psu@gmail.com
SPDX Parser for #101