Skip to content

Conversation

zvigrinberg
Copy link
Contributor

@zvigrinberg zvigrinberg commented Mar 7, 2024

Description

Main component in SBOM being generated is sometimes missing namespace Or version, it happens only for maven and npm component analysis:

  1. in maven, it happens because of existence of parent pom, and pom.xml not specifying the groupId ( mapped to namespace in sbom' purl) or version, and then effectively inherits them from parent.
  2. in npm, if package.json doesn't specify version, then it happens, and in npm, the package name can be comprised from namespace/package, or only package, in the latter case, namespace Will be not populated in purl of npm, and it's ok as it's not mandatory for npm.

fixes JIRA APPENG-2318

Checklist

  • I have followed this repository's contributing guidelines.
  • I will adhere to the project's code of conduct.

Additional information

Anything else?

and resolve the binary name according to the context of execution

Signed-off-by: Zvi Grinberg <zgrinber@redhat.com>
npm - take default version if version doesn't exists, and maven - take the data from effective pom instead of from actual pom

Signed-off-by: Zvi Grinberg <zgrinber@redhat.com>
need to choose the parent aggregator pom for the root component

Signed-off-by: Zvi Grinberg <zgrinber@redhat.com>
@zvigrinberg zvigrinberg force-pushed the hotfix/fix-missing-version-namespace branch from eb8aed2 to 7f0f669 Compare March 7, 2024 16:29
@zvigrinberg zvigrinberg changed the title fix: fix missing version namespace in maven & npm fix: fix missing version/namespace in maven & npm Mar 7, 2024
@zvigrinberg zvigrinberg merged commit 0c128eb into main Mar 7, 2024
@zvigrinberg zvigrinberg deleted the hotfix/fix-missing-version-namespace branch March 7, 2024 16:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant