Skip to content

Commit 5dfd01e

Browse files
andrewandrew
authored
Use shared sbom parser for mirror sources (#510)
* Use shared sbom parser for mirror sources * Use sbom v0.1.7 release
1 parent 6d771a8 commit 5dfd01e

5 files changed

Lines changed: 86 additions & 94 deletions

File tree

‎go.mod‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ go 1.26.7
44

55
require (
66
github.com/BurntSushi/toml v1.6.0
7-
github.com/CycloneDX/cyclonedx-go v0.12.0
87
github.com/Masterminds/semver/v3 v3.5.0
98
github.com/aws/aws-sdk-go-v2/config v1.33.7
109
github.com/aws/aws-sdk-go-v2/service/ecr v1.66.2
@@ -17,6 +16,7 @@ require (
1716
github.com/git-pkgs/magic v0.5.0
1817
github.com/git-pkgs/purl v0.1.21
1918
github.com/git-pkgs/registries v0.10.0
19+
github.com/git-pkgs/sbom v0.1.7
2020
github.com/git-pkgs/spdx v0.3.3
2121
github.com/git-pkgs/vers v0.7.2
2222
github.com/git-pkgs/vulns v0.2.4
@@ -26,7 +26,6 @@ require (
2626
github.com/opencontainers/go-digest v1.0.0
2727
github.com/prometheus/client_golang v1.25.0
2828
github.com/prometheus/client_model v0.6.3
29-
github.com/spdx/tools-golang v0.5.7
3029
github.com/swaggo/swag v1.16.6
3130
gocloud.dev v0.46.0
3231
golang.org/x/mod v0.41.0
@@ -49,7 +48,6 @@ require (
4948
github.com/KyleBanks/depth v1.2.1 // indirect
5049
github.com/PuerkitoBio/purell v1.1.1 // indirect
5150
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
52-
github.com/anchore/go-struct-converter v0.1.0 // indirect
5351
github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
5452
github.com/aws/aws-sdk-go-v2 v1.47.1 // indirect
5553
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.11 // indirect

‎go.sum‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,6 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 h1:4iB+IesclUX
3535
github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
3636
github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
3737
github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
38-
github.com/CycloneDX/cyclonedx-go v0.12.0 h1:/7Jum36UA6V043tQZ/fE3jf+Nf9gn/qxUFfd7QReMy8=
39-
github.com/CycloneDX/cyclonedx-go v0.12.0/go.mod h1:V2577HhxDDCDLYfkm55WJrz16nHTfyQZwcWUBSG7Z28=
4038
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 h1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=
4139
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM=
4240
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
@@ -52,8 +50,6 @@ github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbt
5250
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
5351
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
5452
github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
55-
github.com/anchore/go-struct-converter v0.1.0 h1:2rDRssAl6mgKBSLNiVCMADgZRhoqtw9dedlWa0OhD30=
56-
github.com/anchore/go-struct-converter v0.1.0/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
5753
github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
5854
github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
5955
github.com/aws/aws-sdk-go-v2 v1.47.1 h1:uOIZnp4PK3ZhKI0dNrJrhTEsLxbpXHTAJlwoS1pvAtw=
@@ -99,8 +95,6 @@ github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqx
9995
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
10096
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
10197
github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
102-
github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
103-
github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
10498
github.com/cenk/backoff v2.2.1+incompatible h1:djdFT7f4gF2ttuzRKPbMOWgZajgesItGLwG5FTQKmmE=
10599
github.com/cenk/backoff v2.2.1+incompatible/go.mod h1:7FtoeaSnHoZnmZzz47cM35Y9nSW7tNyaidugnHTaFDE=
106100
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -110,8 +104,6 @@ github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7X
110104
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
111105
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
112106
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
113-
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
114-
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
115107
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
116108
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
117109
github.com/ecosyste-ms/ecosystems-go v0.5.0 h1:qZqgar3Do9RrtW327OXlsrGKiRvNdeX8CmXb1aX4Njo=
@@ -145,6 +137,8 @@ github.com/git-pkgs/purl v0.1.21 h1:PDZUX43lxIiXPn2eHcsNiiiwQo+HajntZ/4TwSvCGlw=
145137
github.com/git-pkgs/purl v0.1.21/go.mod h1:4dOmris48ehjiKmWBqSmMHguUQht48BLeXW+hQUnuj0=
146138
github.com/git-pkgs/registries v0.10.0 h1:0goaC5mxw9MglS/XOm2De7fkPBWCCerelm7RPrPh9hQ=
147139
github.com/git-pkgs/registries v0.10.0/go.mod h1:bKxgdy/PwnzQXL2FnOktmSQHTKk6B85MA4VtvvYItPc=
140+
github.com/git-pkgs/sbom v0.1.7 h1:4eboy/Yed/SC9ZcC/xT50iywHPzWbmCU7azDb5T1RbA=
141+
github.com/git-pkgs/sbom v0.1.7/go.mod h1:KIkZX0v31l62SeFsi2qsQXcZRVrAXvIdPQ4x4en+G2M=
148142
github.com/git-pkgs/spdx v0.3.3 h1:xXlUoZzjDSkwxC6mWHfaW+kc8a0+LH6d+gGHuZWftqI=
149143
github.com/git-pkgs/spdx v0.3.3/go.mod h1:n9rAicgw+Wqtfursju6oKaAL6cUCTiIS926mb1KWoKU=
150144
github.com/git-pkgs/vers v0.7.2 h1:Ctex1O+Ai/FONmyDaw37EolBXg0og6UdxbCjjYbeRHs=
@@ -253,8 +247,6 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjL
253247
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
254248
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
255249
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
256-
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
257-
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
258250
github.com/prometheus/client_golang v1.25.0 h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=
259251
github.com/prometheus/client_golang v1.25.0/go.mod h1:j2X/4/kaQHLPnmyEU8zjmkndo1T317VpCIQEml8LTKk=
260252
github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
@@ -271,8 +263,6 @@ github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529 h1:18kd+8ZUlt/ARXhljq+
271263
github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529/go.mod h1:qe5TWALJ8/a1Lqznoc5BDHpYX/8HU60Hm2AwRmqzxqA=
272264
github.com/rubyist/circuitbreaker v2.2.1+incompatible h1:KUKd/pV8Geg77+8LNDwdow6rVCAYOp8+kHUyFvL6Mhk=
273265
github.com/rubyist/circuitbreaker v2.2.1+incompatible/go.mod h1:Ycs3JgJADPuzJDwffe12k6BZT8hxVi6lFK+gWYJLN4A=
274-
github.com/spdx/tools-golang v0.5.7 h1:+sWcKGnhwp3vLdMqPcLdA6QK679vd86cK9hQWH3AwCg=
275-
github.com/spdx/tools-golang v0.5.7/go.mod h1:jg7w0LOpoNAw6OxKEzCoqPC2GCTj45LyTlVmXubDsYw=
276266
github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
277267
github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
278268
github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
@@ -283,16 +273,8 @@ github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWD
283273
github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
284274
github.com/swaggo/swag v1.16.6 h1:qBNcx53ZaX+M5dxVyTrgQ0PJ/ACK+NzhwcbieTt+9yI=
285275
github.com/swaggo/swag v1.16.6/go.mod h1:ngP2etMK5a0P3QBizic5MEwpRmluJZPHjXcMoj4Xesg=
286-
github.com/terminalstatic/go-xsd-validate v0.1.8 h1:UVrTCy1j3DhwaYTTUF+QYO/Nan13S0tf+Jwi+p45Bf0=
287-
github.com/terminalstatic/go-xsd-validate v0.1.8/go.mod h1:1kb47fi2c6onlf+B7UrrQ9VYraOhcYwFm3iG+J6F4Zo=
288276
github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
289277
github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
290-
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
291-
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
292-
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
293-
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
294-
github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
295-
github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
296278
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
297279
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
298280
go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=

‎internal/mirror/source.go‎

Lines changed: 9 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,13 @@
11
package mirror
22

33
import (
4-
"bytes"
54
"context"
6-
"encoding/json"
75
"fmt"
86

9-
cdx "github.com/CycloneDX/cyclonedx-go"
107
"github.com/git-pkgs/purl"
118
"github.com/git-pkgs/registries"
129
_ "github.com/git-pkgs/registries/all"
13-
spdxjson "github.com/spdx/tools-golang/json"
14-
"github.com/spdx/tools-golang/spdx"
15-
spdxtv "github.com/spdx/tools-golang/tagvalue"
10+
"github.com/git-pkgs/sbom"
1611
)
1712

1813
// PackageVersion identifies a specific package version to mirror.
@@ -130,75 +125,20 @@ func (s *SBOMSource) Enumerate(ctx context.Context, fn func(PackageVersion) erro
130125
}
131126

132127
func (s *SBOMSource) extractPURLs() ([]string, error) {
133-
// Try CycloneDX first
134-
if purls, err := extractCycloneDXPURLs(s.Data); err == nil && len(purls) > 0 {
135-
return purls, nil
136-
}
137-
138-
// Try SPDX JSON
139-
if purls, err := extractSPDXJSONPURLs(s.Data); err == nil && len(purls) > 0 {
140-
return purls, nil
141-
}
142-
143-
// Try SPDX tag-value
144-
if purls, err := extractSPDXTVPURLs(s.Data); err == nil && len(purls) > 0 {
145-
return purls, nil
146-
}
147-
148-
return nil, fmt.Errorf("could not parse SBOM as CycloneDX or SPDX")
149-
}
150-
151-
func extractCycloneDXPURLs(data []byte) ([]string, error) {
152-
bom := new(cdx.BOM)
153-
if err := json.Unmarshal(data, bom); err != nil {
154-
// Try XML
155-
decoder := cdx.NewBOMDecoder(bytes.NewReader(data), cdx.BOMFileFormatXML)
156-
bom = new(cdx.BOM)
157-
if err := decoder.Decode(bom); err != nil {
158-
return nil, err
159-
}
160-
}
161-
162-
if bom.Components == nil {
163-
return nil, nil
164-
}
165-
166-
var purls []string
167-
for _, c := range *bom.Components {
168-
if c.PackageURL != "" {
169-
purls = append(purls, c.PackageURL)
170-
}
171-
}
172-
return purls, nil
173-
}
174-
175-
func extractSPDXJSONPURLs(data []byte) ([]string, error) {
176-
doc, err := spdxjson.Read(bytes.NewReader(data))
177-
if err != nil {
178-
return nil, err
179-
}
180-
return extractSPDXDocPURLs(doc), nil
181-
}
182-
183-
func extractSPDXTVPURLs(data []byte) ([]string, error) {
184-
doc, err := spdxtv.Read(bytes.NewReader(data))
128+
doc, err := sbom.Parse(s.Data)
185129
if err != nil {
186130
return nil, err
187131
}
188-
return extractSPDXDocPURLs(doc), nil
189-
}
190-
191-
func extractSPDXDocPURLs(doc *spdx.Document) []string {
192-
if doc == nil {
193-
return nil
194-
}
195132
var purls []string
196-
for _, pkg := range doc.Packages {
197-
for _, ref := range pkg.PackageExternalReferences {
198-
if ref.RefType == "purl" {
133+
for _, p := range doc.Packages {
134+
for _, ref := range p.ExternalRefs {
135+
if ref.Type == "purl" && ref.Locator != "" {
199136
purls = append(purls, ref.Locator)
200137
}
201138
}
202139
}
203-
return purls
140+
if len(purls) == 0 {
141+
return nil, fmt.Errorf("SBOM contains no package URLs")
142+
}
143+
return purls, nil
204144
}

‎internal/mirror/source_formats_test.go‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
package mirror
2+
3+
import (
4+
"context"
5+
"reflect"
6+
"testing"
7+
)
8+
9+
func TestSBOMSourcePreservesPackageIdentities(t *testing.T) {
10+
for name, data := range map[string]string{
11+
"CycloneDX JSON": `{"components":[
12+
{"name":"shared","version":"1.0","purl":"pkg:npm/%40alpha/shared@1.0"},
13+
{"name":"shared","version":"1.0","purl":"pkg:npm/%40beta/shared@1.0"}]}`,
14+
"CycloneDX XML": `<bom xmlns="http://cyclonedx.org/schema/bom/1.6"><components>
15+
<component type="library"><name>shared</name><version>1.0</version><purl>pkg:npm/%40alpha/shared@1.0</purl></component>
16+
<component type="library"><name>shared</name><version>1.0</version><purl>pkg:npm/%40beta/shared@1.0</purl></component>
17+
</components></bom>`,
18+
"SPDX JSON": `{"spdxVersion":"SPDX-2.3","packages":[{"name":"shared","versionInfo":"1.0","externalRefs":[
19+
{"referenceType":"purl","referenceLocator":"pkg:npm/%40alpha/shared@1.0"},
20+
{"referenceType":"purl","referenceLocator":"pkg:npm/%40beta/shared@1.0"}]}]}`,
21+
"SPDX tag-value": `DataLicense: CC0-1.0
22+
SPDXVersion: SPDX-2.3
23+
SPDXID: SPDXRef-DOCUMENT
24+
DocumentName: example
25+
DocumentNamespace: https://example.com/sbom
26+
PackageName: shared
27+
SPDXID: SPDXRef-shared
28+
PackageVersion: 1.0
29+
ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40alpha/shared@1.0
30+
ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40beta/shared@1.0
31+
`,
32+
} {
33+
t.Run(name, func(t *testing.T) {
34+
source := &SBOMSource{Data: []byte(data), Name: name}
35+
var got []PackageVersion
36+
err := source.Enumerate(context.Background(), func(pv PackageVersion) error {
37+
got = append(got, pv)
38+
return nil
39+
})
40+
if err != nil {
41+
t.Fatal(err)
42+
}
43+
want := []PackageVersion{
44+
{Ecosystem: "npm", Name: "@alpha/shared", Version: "1.0"},
45+
{Ecosystem: "npm", Name: "@beta/shared", Version: "1.0"},
46+
}
47+
if !reflect.DeepEqual(got, want) {
48+
t.Errorf("Enumerate = %+v, want %+v", got, want)
49+
}
50+
})
51+
}
52+
}
53+
54+
func TestSBOMSourcePreservesImageOptions(t *testing.T) {
55+
source := &SBOMSource{
56+
Data: []byte(`{"bomFormat":"CycloneDX","components":[{"name":"alpine","purl":"pkg:docker/library/alpine@3.20?repository_url=ghcr.io&arch=arm64"}]}`),
57+
Platforms: []string{"linux/amd64"},
58+
}
59+
var got []PackageVersion
60+
if err := source.Enumerate(context.Background(), func(pv PackageVersion) error {
61+
got = append(got, pv)
62+
return nil
63+
}); err != nil {
64+
t.Fatal(err)
65+
}
66+
want := []PackageVersion{{
67+
Ecosystem: "docker", Name: "library/alpine", Version: "3.20",
68+
Qualifiers: map[string]string{"repository_url": "ghcr.io", "arch": "arm64"},
69+
Platforms: []string{"linux/amd64"},
70+
}}
71+
if !reflect.DeepEqual(got, want) {
72+
t.Errorf("Enumerate = %+v, want %+v", got, want)
73+
}
74+
}

‎internal/mirror/source_test.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,8 +211,6 @@ func TestSBOMSourceEmptyCycloneDX(t *testing.T) {
211211
"bomFormat": "CycloneDX",
212212
"specVersion": "1.4",
213213
}
214-
// This should fall through to SPDX parsing, which will also fail,
215-
// resulting in an error about not being able to parse
216214
source := &SBOMSource{Data: marshalJSON(t, bom)}
217215
err := source.Enumerate(context.Background(), func(pv PackageVersion) error {
218216
return nil

0 commit comments

Comments
 (0)