github.com/lineaje-labs/syft@v0.98.1-0.20231227153149-9e393f60ff1b/syft/format/common/cyclonedxhelpers/cpe.go (about) 1 package cyclonedxhelpers 2 3 import ( 4 "github.com/CycloneDX/cyclonedx-go" 5 6 "github.com/anchore/syft/syft/cpe" 7 "github.com/anchore/syft/syft/pkg" 8 "github.com/lineaje-labs/syft/internal/log" 9 ) 10 11 func encodeSingleCPE(p pkg.Package) string { 12 // Since the CPEs in a package are sorted by specificity 13 // we can extract the first CPE as the one to output in cyclonedx 14 if len(p.CPEs) > 0 { 15 return cpe.String(p.CPEs[0]) 16 } 17 return "" 18 } 19 20 func encodeCPEs(p pkg.Package) (out []cyclonedx.Property) { 21 for i, c := range p.CPEs { 22 // first CPE is "most specific" and already encoded as the component CPE 23 if i == 0 { 24 continue 25 } 26 out = append(out, cyclonedx.Property{ 27 Name: "syft:cpe23", 28 Value: cpe.String(c), 29 }) 30 } 31 return 32 } 33 34 func decodeCPEs(c *cyclonedx.Component) (out []cpe.CPE) { 35 if c.CPE != "" { 36 cp, err := cpe.New(c.CPE) 37 if err != nil { 38 log.Warnf("invalid CPE: %s", c.CPE) 39 } else { 40 out = append(out, cp) 41 } 42 } 43 44 if c.Properties != nil { 45 for _, p := range *c.Properties { 46 if p.Name == "syft:cpe23" { 47 cp, err := cpe.New(p.Value) 48 if err != nil { 49 log.Warnf("invalid CPE: %s", p.Value) 50 } else { 51 out = append(out, cp) 52 } 53 } 54 } 55 } 56 57 return 58 }