fix: omit goarch/goos PURL qualifiers from mod SBOMs - #746
Open
arpitjain099 wants to merge 1 commit into
Open
Conversation
Module SBOMs are platform independent, so embedding the build host's GOOS/GOARCH in component PURLs is incorrect: the same module produces different PURLs on different machines, which breaks PURL-based matching and deduplication across SBOMs. Add a platform-neutral Module.ModulePackageURL and a WithModulePURL converter option, and use it in the mod generator for the main component and dependencies. The app and bin generators are left untouched, so they still emit goos/goarch on the build-environment main component. -short-purls still takes precedence when enabled. Fixes CycloneDX#662 Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #662. A mod SBOM is platform independent, but its component PURLs currently carry goarch/goos from the build host, so the same module produces different PURLs on different machines and PURL-based matching or dedup across SBOMs breaks. This adds a platform-neutral module PURL (Module.ModulePackageURL and a WithModulePURL converter option) and uses it in the mod generator for both the main component and dependencies, matching what the app and bin generators already do for their dependency graphs and what nscuro noted back in #148. app and bin themselves are untouched, so they still emit goos/goarch on the build-environment main component, and -short-purls still wins when it's set.
I regenerated the mod snapshots with UPDATE_SNAPSHOTS=true; the only diff is goarch/goos dropping off the mod PURLs, and go test ./pkg/generate/... plus the internal sbom/gomod tests stay green (app and bin included). Thanks for taking a look.