Commits on Mar 13, 2024

1. Avoid false positives in self-generated SBOM …

   The Syft tests include many package files. Syft reports the packages
   (used only as unit test data) in the SBOM. Exclude them.
   
   Tested on the redhat-latest branch with
   
       dist/syft . -o cyclonedx-json 2>/dev/null |
       jq '.components[].purl | try match("pkg:[^/]*").string catch "<no purl>"' |
       sort | uniq -c | sort -n
   
   Before:
   
         1 "pkg:rpm"
         2 "pkg:ebuild"
         2 "pkg:github"
         2 "pkg:nix"
         2 "pkg:otp"
         4 "pkg:composer"
        10 "pkg:swift"
        13 "pkg:cargo"
        13 "pkg:pub"
        14 "<no purl>"
        20 "pkg:conan"
        28 "pkg:nuget"
        39 "pkg:pypi"
        44 "pkg:hex"
        46 "pkg:cocoapods"
        54 "pkg:generic"
        55 "pkg:hackage"
        57 "pkg:maven"
        57 "pkg:npm"
       109 "pkg:gem"
       424 "pkg:golang"
   
   After:
   
       408 "pkg:golang"
   
   Signed-off-by: Adam Cmiel <[email protected]>

   

   chmeliik committed Mar 13, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for b5c69f1
   • Browse repository at this point

   Copy the full SHA

   b5c69f1 View commit details

   Browse the repository at this point in the history