fix(spdx): add workaround for no src packages (#4118)

aquasecurity · Apr 28, 2023 · 1be1e2e · 1be1e2e
1 parent 45bc9e0
commit 1be1e2e
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/pkg/sbom/cyclonedx/marshal.go b/pkg/sbom/cyclonedx/marshal.go
@@ -392,6 +392,9 @@ func (e *Marshaler) reportToCdxComponent(r types.Report) (*cdx.Component, error)
 			component.BOMRef = p.ToString()
 			component.PackageURL = p.ToString()
 		}
+	case ftypes.ArtifactVM:
+		component.Type = cdx.ComponentTypeContainer
+		component.BOMRef = e.newUUID().String()
 	case ftypes.ArtifactFilesystem, ftypes.ArtifactRemoteRepository:
 		component.Type = cdx.ComponentTypeApplication
 		component.BOMRef = e.newUUID().String()

diff --git a/pkg/sbom/spdx/marshal.go b/pkg/sbom/spdx/marshal.go
@@ -319,7 +319,7 @@ func (m *Marshaler) pkgToSpdxPackage(t, pkgDownloadLocation string, class types.
 	}
 
 	var pkgSrcInfo string
-	if class == types.ClassOSPkg {
+	if class == types.ClassOSPkg && pkg.SrcName != "" {
 		pkgSrcInfo = fmt.Sprintf("%s: %s %s", SourcePackagePrefix, pkg.SrcName, utils.FormatSrcVersion(pkg))
 	}