cyclonedx-linux-generator icon indicating copy to clipboard operation
cyclonedx-linux-generator copied to clipboard

Published 20 hours ago • verified publisher icon CycloneDX

fix: make a purl DT can recognize, add CPE

Open djcrabhat opened this issue 2 years ago • 1 comments

Make the purl that is output align with what DependencyTrack expects. I understand this could potentially be breaking for those who expect the purl to be where the package was downloaded from. Added a details map Download-Url key for that old value.

Reference: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#rpm

But I know that purl's don't seem that well supported for OS packages. So I'm also adding CPEs for RedHat. (I'm gonna trick DependencyTrack in to recognizing vulnerable packages, if by hook or by crook! 😆)

Closes #11

djcrabhat avatar Sep 04 '22 04:09 djcrabhat

Can somebody merge this PR please?

stephan-wolf-ais avatar Apr 27 '23 13:04 stephan-wolf-ais