Merge pull request #228 from interlynk-io/fix/quality

Fix/quality

Dockerfile

@@ -1,11 +1,12 @@
-FROM golang:1.20-alpine AS builder
+FROM golang:1.22.2-alpine AS builder
 LABEL org.opencontainers.image.source="https://github.com/interlynk-io/sbomqs"
 
 RUN apk add --no-cache make git
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
+
 RUN make ; make build
 
 FROM scratch
@@ -17,4 +18,4 @@ LABEL org.opencontainers.image.licenses=Apache-2.0
 COPY --from=builder /app/build/sbomqs /app/sbomqs
 ENV INTERLYNK_DISABLE_VERSION_CHECK=true
 
-ENTRYPOINT [ "/app/sbomqs" ]
+ENTRYPOINT [ "/app/sbomqs" ]

pkg/sbom/spdx.go

@@ -188,7 +188,9 @@ func (s *spdxDoc) parseComps() {
 			nc.supplier = *supp
 		}
 		nc.supplierName = s.addSupplierName(index)
-		nc.sourceCodeHash = sc.PackageVerificationCode.Value
+		if sc.PackageOriginator != nil {
+			nc.sourceCodeHash = sc.PackageVerificationCode.Value
+		}
 
 		//nc.sourceCodeUrl //no conlusive way to get this from SPDX
 		if strings.ToLower(sc.PackageDownloadLocation) == "noassertion" || strings.ToLower(sc.PackageDownloadLocation) == "none" {