* properly implement unescaping for v2.3 CPEs
* extend the CPE we write to the sbom with the version
* always write v2.2 CPEs to the sbom since those are easier to build
* in case a CPE contains a version, use that over pkgver
Fixes#12
it was extended to allow duplicate keys at some point
to support PURL, and just forked. Update the other users
to deal with this again and merge teh code.
In case a PURL reference has a version included we use that instead
of the pkgver.
This is helpful in case the version format is different on pypi for
example, or when referencing github and the version tag is prefixed with "v".
We have multiple packages with the same CPE, and since we now have
multiple components with the same name they get merged by grype into
one, which means each SBOM component can point to multiple pkgbase
values.
In case of components with purl the name has to match the name of
the project as encoded in the prul (for whatever reason) or otherwise
grype will not find any CVEs for them.
Currently we are using the name match pkgbase, so we can connect
vulns to packages in msys2-web.
With this no longer working add a "msys2:pkgbase" property to the SBOM.
But since grype throws out everything non-essential from the input SBOM
add a command that merges the property from the source to the enriched
SBOM. And since we can't even have an ID to connect components there
match by comparing various fields (name, version, cpe, purl).
This means the new process is like this:
* Generate SBOM with "sbom create"
* Run grype to generate cdx SBOM with VEX
* Add properties to grype SBOM via "sbom merge"
* In msys2-web instead of taking "name" look for a property called "msys2:pkgbase"
While at it also use the CPE project name for the SBOM component name, and
remove the version from the CPE, since grype doesn't seem to use it, and
we avoid having to escape things in the CPE.
And also try to normalize versions a bit.
Bash variables starting with msys2_ or mingw_ in the PKGBUILD will
now be included in the srcinfo cache under "extra". This supports
both strings and arrays of strings.
Christoph Reiter