diff --git a/cmd/osv-scanner/__snapshots__/main_test.snap b/cmd/osv-scanner/__snapshots__/main_test.snap index 0bbfb40a2e6..3d8e9182b58 100755 --- a/cmd/osv-scanner/__snapshots__/main_test.snap +++ b/cmd/osv-scanner/__snapshots__/main_test.snap @@ -542,9 +542,8 @@ Scanning dir ./fixtures/sbom-insecure/ Scanned /fixtures/sbom-insecure/alpine.cdx.xml as CycloneDX SBOM and found 14 packages Scanned /fixtures/sbom-insecure/bad-purls.cdx.xml as CycloneDX SBOM and found 8 packages Ignored 6 packages with invalid PURLs -Ignored invalid PURL "pkg:pypi/" -Ignored invalid PURL "pkg:///" Ignored invalid PURL "/" +Ignored invalid PURL "pkg:///" Ignored invalid PURL "pkg:apk/alpine/@1.36.1-r27?arch=x86_64&upstream=busybox&distro=alpine-3.17.2" Ignored invalid PURL "pkg:pypi/" Scanned /fixtures/sbom-insecure/postgres-stretch.cdx.xml as CycloneDX SBOM and found 136 packages @@ -698,9 +697,8 @@ No issues found [TestRun/one_specific_supported_sbom_with_invalid_PURLs - 1] Scanned /fixtures/sbom-insecure/bad-purls.cdx.xml as CycloneDX SBOM and found 8 packages Ignored 6 packages with invalid PURLs -Ignored invalid PURL "pkg:pypi/" -Ignored invalid PURL "pkg:///" Ignored invalid PURL "/" +Ignored invalid PURL "pkg:///" Ignored invalid PURL "pkg:apk/alpine/@1.36.1-r27?arch=x86_64&upstream=busybox&distro=alpine-3.17.2" Ignored invalid PURL "pkg:pypi/" No issues found diff --git a/pkg/osvscanner/osvscanner.go b/pkg/osvscanner/osvscanner.go index 4b90c0e1c13..3a38366d309 100644 --- a/pkg/osvscanner/osvscanner.go +++ b/pkg/osvscanner/osvscanner.go @@ -506,6 +506,7 @@ func scanSBOMFile(r reporter.Reporter, path string, fromFSScan bool) ([]scannedP len(ignoredPURLs), output.Form(len(ignoredPURLs), "package", "packages"), ) + slices.Sort(ignoredPURLs) for _, purl := range slices.Compact(ignoredPURLs) { r.Warnf( "Ignored invalid PURL \"%s\"\n",