search

phylum-dev / cli

Command line interface for the Phylum API
https://phylum.io
GNU General Public License v3.0
99 stars 10 forks source link

Use `SPDX` download location to determine ecosystem #1384

Closed ejortega closed 3 months ago

ejortega commented 3 months ago

Overview

The download location can be parsed and matched with known package registries. This is only done when package locators or when a PURL is present, but can also be used when if we have enough information from the package fields.

How To Reproduce

Steps to reproduce this behavior:

  1. Attempt to parse a SPDX sbom missing an external ref
  2. See error for missing external ref or package location

Expected Behavior

Should be able to handle sbom packages with just name, version and download location.