create isoccur for top level package when artifact is found (#2137)

Signed-off-by: pxp928 <parth.psu@gmail.com>
guacsec · Sep 19, 2024 · f5e60a9 · f5e60a9
1 parent 430b768
commit f5e60a9
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/internal/testing/testdata/testdata.go b/internal/testing/testdata/testdata.go
@@ -1127,6 +1127,16 @@ var (
 	}
 
 	CdxIngestionPredicates = assembler.IngestPredicates{
+		IsOccurrence: []assembler.IsOccurrenceIngest{
+			{
+				Pkg: cdxTopLevelPack,
+				Artifact: &model.ArtifactInputSpec{
+					Algorithm: "sha256",
+					Digest:    "6ad5b696af3ca05a048bd29bf0f623040462638cb0b29c8d702cbb2805687388",
+				},
+				IsOccurrence: isOccurrenceJustifyTopPkg,
+			},
+		},
 		IsDependency: CdxDeps,
 		HasSBOM:      CdxHasSBOM,
 	}

diff --git a/pkg/ingestor/parser/cyclonedx/parser_cyclonedx.go b/pkg/ingestor/parser/cyclonedx/parser_cyclonedx.go
@@ -387,6 +387,8 @@ func (c *cyclonedxParser) GetPredicates(ctx context.Context) *assembler.IngestPr
 					logger.Infof("CDX artifact was not parsable: %v", err)
 				} else {
 					topLevelArts = append(topLevelArts, artInput)
+					// append to packageArtifacts so that isOccurrence is created
+					c.packageArtifacts[c.cdxBom.Metadata.Component.BOMRef] = append(c.packageArtifacts[c.cdxBom.Metadata.Component.BOMRef], artInput)
 					logger.Infof("getArtInput %v", artInput)
 				}
 			}