Support-build-info-collection-for-conan

[reshmifrog]

• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• The pull request is targeting the master branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....

---

add support for collectiong build info for conan

[naveenku-jfrog]

LGTM. Approved.

[github-actions]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 1 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	1 Issues Found 1 High
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	Not Found
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Direct Dependencies	Impacted Dependency	Fixed Versions
High	CVE-2025-66564	Not Applicable	github.com/sigstore/timestamp-authority:v1.2.8 github.com/jfrog/jfrog-cli-evidence:v0.8.3-0.20251116083852-12dc534b4d13 github.com/sigstore/sigstore-go:v1.1.1	github.com/sigstore/timestamp-authority v1.2.8	[2.0.3]

🔖 Details

Vulnerability Details

Contextual Analysis:	Not Applicable
Direct Dependencies:	github.com/sigstore/timestamp-authority:v1.2.8, github.com/jfrog/jfrog-cli-evidence:v0.8.3-0.20251116083852-12dc534b4d13, github.com/sigstore/sigstore-go:v1.1.1
Impacted Dependency:	github.com/sigstore/timestamp-authority:v1.2.8
Fixed Versions:	[2.0.3]
CVSS V3:	7.5

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.

---

🐸 JFrog Frogbot