Skip to content

Commit 88bab7c

Browse files
JimFuller-RedHatctron
JimFuller-RedHat
authored and
ctron
committed
analysis latest: add tests for TC-2719 confirming components with multiple values in purl field are matched correctly.
1 parent f59ccca commit 88bab7c

File tree

5 files changed

+714
-0
lines changed

5 files changed

+714
-0
lines changed

‎etc/test-data/cyclonedx/rh/latest_filters/TC-2719/firefox.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:b7ee7d76-e59d-3ec7-8ff0-82230d0ad57b","version":1,"metadata":{"timestamp":"2025-07-01T12:07:53Z","tools":{"components":[{"type":"application","author":"Red Hat","name":"SBOMer","version":"44d356cd"}]},"component":{"type":"operating-system","bom-ref":"RHEL-8.10.0.Z.MAIN+EUS","supplier":{"name":"Red Hat","url":["https://www.redhat.com"]},"name":"Red Hat Enterprise Linux 8","version":"RHEL-8.10.0.Z.MAIN+EUS","evidence":{"identity":[{"field":"cpe","concludedValue":"cpe:/a:redhat:enterprise_linux:8.10::appstream"},{"field":"cpe","concludedValue":"cpe:/a:redhat:enterprise_linux:8::appstream"}]}},"supplier":{"name":"Red Hat","url":["https://www.redhat.com"]},"properties":[{"name":"redhat:advisory_id","value":"151443"}]},"components":[{"type":"library","bom-ref":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src","supplier":{"name":"Red Hat","url":["https://www.redhat.com"]},"name":"firefox","version":"128.12.0-1.el8_10","hashes":[{"alg":"SHA-256","content":"39f3e620147a28a63c0023be5d0ddc80d7a8a1a7ba6dc533909acc602163198b"}],"licenses":[{"expression":"NOASSERTION"}],"purl":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src","evidence":{"identity":[{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-aarch64-appstream-source-rpms__8"},{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-x86_64-appstream-source-rpms__8_DOT_10"},{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-ppc64le-appstream-source-rpms__8"},{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-x86_64-appstream-source-rpms__8"},{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-s390x-appstream-source-rpms__8_DOT_10"},{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-s390x-appstream-source-rpms__8"},{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-aarch64-appstream-source-rpms__8_DOT_10"},{"field":"purl","concludedValue":"pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src&repository_id=rhel-8-for-ppc64le-appstream-source-rpms__8_DOT_10"}]}}],"dependencies":[{"ref":"RHEL-8.10.0.Z.MAIN+EUS","dependsOn":[],"provides":["pkg:rpm/redhat/firefox@128.12.0-1.el8_10?arch=src"]}]}

‎etc/test-data/spdx/rh/latest/TC-2719/mariadb-9.7-1763396552-binary.json‎

Lines changed: 263 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,263 @@
1+
{
2+
"SPDXID": "SPDXRef-DOCUMENT",
3+
"creationInfo": {
4+
"created": "2025-11-17T16:38:55Z",
5+
"creators": [
6+
"Organization: Red Hat",
7+
"Tool: Konflux CI",
8+
"Tool: Mobster-1.1.0",
9+
"Tool: Mobster-1.0.0"
10+
]
11+
},
12+
"dataLicense": "CC0-1.0",
13+
"name": "registry.redhat.io/rhel9/mariadb-1011@sha256:0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547",
14+
"spdxVersion": "SPDX-2.3",
15+
"documentNamespace": "https://konflux-ci.dev/spdxdocs/quay.io/redhat-user-workloads/osci-rhel-containers-tenant/rhel-9-7/mariadb-1011-9-7@sha256:0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547-d164c023-3587-4340-9ff2-5f1ac3c8a131",
16+
"packages": [
17+
{
18+
"SPDXID": "SPDXRef-image-index",
19+
"checksums": [
20+
{
21+
"algorithm": "SHA256",
22+
"checksumValue": "0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547"
23+
}
24+
],
25+
"downloadLocation": "NOASSERTION",
26+
"externalRefs": [
27+
{
28+
"referenceCategory": "PACKAGE-MANAGER",
29+
"referenceType": "purl",
30+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547?repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7"
31+
},
32+
{
33+
"referenceCategory": "PACKAGE-MANAGER",
34+
"referenceType": "purl",
35+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547?repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7-1763396552"
36+
},
37+
{
38+
"referenceCategory": "PACKAGE-MANAGER",
39+
"referenceType": "purl",
40+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547?repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=latest"
41+
},
42+
{
43+
"referenceCategory": "PACKAGE-MANAGER",
44+
"referenceType": "purl",
45+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547?repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1"
46+
},
47+
{
48+
"referenceCategory": "PACKAGE-MANAGER",
49+
"referenceType": "purl",
50+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:0600038402b995e2a189c6c60f6482fd29bc7d4618333d940fa28f6c9bbec547?repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1-1763396552"
51+
}
52+
],
53+
"filesAnalyzed": false,
54+
"licenseDeclared": "NOASSERTION",
55+
"name": "mariadb-1011-9-7",
56+
"supplier": "Organization: Red Hat",
57+
"versionInfo": "256d5aef63bf8cec8fa93e100f526697b76f9c20"
58+
},
59+
{
60+
"SPDXID": "SPDXRef-image-mariadb-1011-9-7-025d33c9c9abf156e737a771da95ab6f1543126004b6190e4623f74f5e1208f2",
61+
"checksums": [
62+
{
63+
"algorithm": "SHA256",
64+
"checksumValue": "a60c2ab360f480c6963fbef0c1d4262c9b0e55aa9c8a5917d800e11fce840355"
65+
}
66+
],
67+
"downloadLocation": "NOASSERTION",
68+
"externalRefs": [
69+
{
70+
"referenceCategory": "PACKAGE-MANAGER",
71+
"referenceType": "purl",
72+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:a60c2ab360f480c6963fbef0c1d4262c9b0e55aa9c8a5917d800e11fce840355?arch=amd64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7"
73+
},
74+
{
75+
"referenceCategory": "PACKAGE-MANAGER",
76+
"referenceType": "purl",
77+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:a60c2ab360f480c6963fbef0c1d4262c9b0e55aa9c8a5917d800e11fce840355?arch=amd64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7-1763396552"
78+
},
79+
{
80+
"referenceCategory": "PACKAGE-MANAGER",
81+
"referenceType": "purl",
82+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:a60c2ab360f480c6963fbef0c1d4262c9b0e55aa9c8a5917d800e11fce840355?arch=amd64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=latest"
83+
},
84+
{
85+
"referenceCategory": "PACKAGE-MANAGER",
86+
"referenceType": "purl",
87+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:a60c2ab360f480c6963fbef0c1d4262c9b0e55aa9c8a5917d800e11fce840355?arch=amd64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1"
88+
},
89+
{
90+
"referenceCategory": "PACKAGE-MANAGER",
91+
"referenceType": "purl",
92+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:a60c2ab360f480c6963fbef0c1d4262c9b0e55aa9c8a5917d800e11fce840355?arch=amd64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1-1763396552"
93+
}
94+
],
95+
"filesAnalyzed": false,
96+
"licenseDeclared": "NOASSERTION",
97+
"name": "mariadb-1011-9-7_amd64",
98+
"supplier": "Organization: Red Hat",
99+
"versionInfo": "256d5aef63bf8cec8fa93e100f526697b76f9c20"
100+
},
101+
{
102+
"SPDXID": "SPDXRef-image-mariadb-1011-9-7-4fe65f11867119c46de3b76d0e3eea77e91ba962d27c0b0a22ed801d8db1d2f5",
103+
"checksums": [
104+
{
105+
"algorithm": "SHA256",
106+
"checksumValue": "2281b94f0874c8aea88e22a46b632452ddcbcfa42d165d4d55fdccf21d9e1b0e"
107+
}
108+
],
109+
"downloadLocation": "NOASSERTION",
110+
"externalRefs": [
111+
{
112+
"referenceCategory": "PACKAGE-MANAGER",
113+
"referenceType": "purl",
114+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:2281b94f0874c8aea88e22a46b632452ddcbcfa42d165d4d55fdccf21d9e1b0e?arch=arm64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7"
115+
},
116+
{
117+
"referenceCategory": "PACKAGE-MANAGER",
118+
"referenceType": "purl",
119+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:2281b94f0874c8aea88e22a46b632452ddcbcfa42d165d4d55fdccf21d9e1b0e?arch=arm64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7-1763396552"
120+
},
121+
{
122+
"referenceCategory": "PACKAGE-MANAGER",
123+
"referenceType": "purl",
124+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:2281b94f0874c8aea88e22a46b632452ddcbcfa42d165d4d55fdccf21d9e1b0e?arch=arm64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=latest"
125+
},
126+
{
127+
"referenceCategory": "PACKAGE-MANAGER",
128+
"referenceType": "purl",
129+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:2281b94f0874c8aea88e22a46b632452ddcbcfa42d165d4d55fdccf21d9e1b0e?arch=arm64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1"
130+
},
131+
{
132+
"referenceCategory": "PACKAGE-MANAGER",
133+
"referenceType": "purl",
134+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:2281b94f0874c8aea88e22a46b632452ddcbcfa42d165d4d55fdccf21d9e1b0e?arch=arm64&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1-1763396552"
135+
}
136+
],
137+
"filesAnalyzed": false,
138+
"licenseDeclared": "NOASSERTION",
139+
"name": "mariadb-1011-9-7_arm64",
140+
"supplier": "Organization: Red Hat",
141+
"versionInfo": "256d5aef63bf8cec8fa93e100f526697b76f9c20"
142+
},
143+
{
144+
"SPDXID": "SPDXRef-image-mariadb-1011-9-7-fd7687d90b93f9cbe457254af0f29f45942984ef0157fe4f842b369160a9069d",
145+
"checksums": [
146+
{
147+
"algorithm": "SHA256",
148+
"checksumValue": "dc3b882972536888e5c27bbc5d8dc3586d8a1fb2182dde3890fb662ea69f9d39"
149+
}
150+
],
151+
"downloadLocation": "NOASSERTION",
152+
"externalRefs": [
153+
{
154+
"referenceCategory": "PACKAGE-MANAGER",
155+
"referenceType": "purl",
156+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:dc3b882972536888e5c27bbc5d8dc3586d8a1fb2182dde3890fb662ea69f9d39?arch=s390x&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7"
157+
},
158+
{
159+
"referenceCategory": "PACKAGE-MANAGER",
160+
"referenceType": "purl",
161+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:dc3b882972536888e5c27bbc5d8dc3586d8a1fb2182dde3890fb662ea69f9d39?arch=s390x&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7-1763396552"
162+
},
163+
{
164+
"referenceCategory": "PACKAGE-MANAGER",
165+
"referenceType": "purl",
166+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:dc3b882972536888e5c27bbc5d8dc3586d8a1fb2182dde3890fb662ea69f9d39?arch=s390x&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=latest"
167+
},
168+
{
169+
"referenceCategory": "PACKAGE-MANAGER",
170+
"referenceType": "purl",
171+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:dc3b882972536888e5c27bbc5d8dc3586d8a1fb2182dde3890fb662ea69f9d39?arch=s390x&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1"
172+
},
173+
{
174+
"referenceCategory": "PACKAGE-MANAGER",
175+
"referenceType": "purl",
176+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:dc3b882972536888e5c27bbc5d8dc3586d8a1fb2182dde3890fb662ea69f9d39?arch=s390x&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1-1763396552"
177+
}
178+
],
179+
"filesAnalyzed": false,
180+
"licenseDeclared": "NOASSERTION",
181+
"name": "mariadb-1011-9-7_s390x",
182+
"supplier": "Organization: Red Hat",
183+
"versionInfo": "256d5aef63bf8cec8fa93e100f526697b76f9c20"
184+
},
185+
{
186+
"SPDXID": "SPDXRef-image-mariadb-1011-9-7-28e9718623f661f7c511cd59907e16e50f12947be39968ee1106072b12bfef40",
187+
"checksums": [
188+
{
189+
"algorithm": "SHA256",
190+
"checksumValue": "32259f85fc3ceba94ae0ac85862240b0b6a1cdf0fe944dce7c48a2b4a8dc7eb9"
191+
}
192+
],
193+
"downloadLocation": "NOASSERTION",
194+
"externalRefs": [
195+
{
196+
"referenceCategory": "PACKAGE-MANAGER",
197+
"referenceType": "purl",
198+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:32259f85fc3ceba94ae0ac85862240b0b6a1cdf0fe944dce7c48a2b4a8dc7eb9?arch=ppc64le&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7"
199+
},
200+
{
201+
"referenceCategory": "PACKAGE-MANAGER",
202+
"referenceType": "purl",
203+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:32259f85fc3ceba94ae0ac85862240b0b6a1cdf0fe944dce7c48a2b4a8dc7eb9?arch=ppc64le&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=9.7-1763396552"
204+
},
205+
{
206+
"referenceCategory": "PACKAGE-MANAGER",
207+
"referenceType": "purl",
208+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:32259f85fc3ceba94ae0ac85862240b0b6a1cdf0fe944dce7c48a2b4a8dc7eb9?arch=ppc64le&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=latest"
209+
},
210+
{
211+
"referenceCategory": "PACKAGE-MANAGER",
212+
"referenceType": "purl",
213+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:32259f85fc3ceba94ae0ac85862240b0b6a1cdf0fe944dce7c48a2b4a8dc7eb9?arch=ppc64le&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1"
214+
},
215+
{
216+
"referenceCategory": "PACKAGE-MANAGER",
217+
"referenceType": "purl",
218+
"referenceLocator": "pkg:oci/mariadb-1011@sha256:32259f85fc3ceba94ae0ac85862240b0b6a1cdf0fe944dce7c48a2b4a8dc7eb9?arch=ppc64le&repository_url=registry.redhat.io/rhel9/mariadb-1011&tag=1-1763396552"
219+
}
220+
],
221+
"filesAnalyzed": false,
222+
"licenseDeclared": "NOASSERTION",
223+
"name": "mariadb-1011-9-7_ppc64le",
224+
"supplier": "Organization: Red Hat",
225+
"versionInfo": "256d5aef63bf8cec8fa93e100f526697b76f9c20"
226+
}
227+
],
228+
"relationships": [
229+
{
230+
"spdxElementId": "SPDXRef-DOCUMENT",
231+
"relatedSpdxElement": "SPDXRef-image-index",
232+
"relationshipType": "DESCRIBES"
233+
},
234+
{
235+
"spdxElementId": "SPDXRef-image-mariadb-1011-9-7-025d33c9c9abf156e737a771da95ab6f1543126004b6190e4623f74f5e1208f2",
236+
"relatedSpdxElement": "SPDXRef-image-index",
237+
"relationshipType": "VARIANT_OF"
238+
},
239+
{
240+
"spdxElementId": "SPDXRef-image-mariadb-1011-9-7-4fe65f11867119c46de3b76d0e3eea77e91ba962d27c0b0a22ed801d8db1d2f5",
241+
"relatedSpdxElement": "SPDXRef-image-index",
242+
"relationshipType": "VARIANT_OF"
243+
},
244+
{
245+
"spdxElementId": "SPDXRef-image-mariadb-1011-9-7-fd7687d90b93f9cbe457254af0f29f45942984ef0157fe4f842b369160a9069d",
246+
"relatedSpdxElement": "SPDXRef-image-index",
247+
"relationshipType": "VARIANT_OF"
248+
},
249+
{
250+
"spdxElementId": "SPDXRef-image-mariadb-1011-9-7-28e9718623f661f7c511cd59907e16e50f12947be39968ee1106072b12bfef40",
251+
"relatedSpdxElement": "SPDXRef-image-index",
252+
"relationshipType": "VARIANT_OF"
253+
}
254+
],
255+
"annotations": [
256+
{
257+
"annotationDate": "2025-11-17T17:22:08Z",
258+
"annotationType": "OTHER",
259+
"annotator": "Tool: Mobster-1.0.0",
260+
"comment": "release_id=23f0a400-7969-41eb-b97b-f6df70339ba9"
261+
}
262+
]
263+
}

0 commit comments

Comments
 (0)