phylum-dev / cli

Command line interface for the Phylum API
https://phylum.io
GNU General Public License v3.0
103 stars 11 forks source link

Parsing BOM files with unsupported ecosystems #1278

Closed ejortega closed 12 months ago

ejortega commented 1 year ago

Overview

When parsing BOM files, we should ignore packages with ecosystems we don't currently support.

How To Reproduce

Steps to reproduce this behavior:

  1. Parse CycloneDX BOM file containing a package such as "pkg:deb/ubuntu/adduser@3.118ubuntu5?arch=all&distro=ubuntu-22.04"
  2. See error below
phylum parse -v docker.sbom.json
:exclamation: Error: could not parse lockfile: docker.sbom.json
Caused by:
    0: Failed to parse lockfile
    1: Could not determine ecosystem

Expected Behavior

Identified but unsupported ecosystems should be ignored.