Skip to content

Fix cbl-mariner purl_type support

Proposal

Support for the cbl-mariner purl type was supposed to be added by Add purl types for Container Scanning OS packag... (#398810 - closed), however, there was an oversight in the implementation, and the cbl_mariner purl type (using an underscore _ instead of a hyphen -) was added by mistake instead.

Since trivy produces an SBOM that uses cbl-mariner as the purl type, this means that these SBOM components will be rejected during ingestion.

Implementation Plan

  1. Update Enums::Sbom::PURL_TYPES to use cbl-mariner instead of cbl_mariner:

    diff --git a/app/models/concerns/enums/sbom.rb b/app/models/concerns/enums/sbom.rb
    index 59aafc32d945..d519b6aac397 100644
    --- a/app/models/concerns/enums/sbom.rb
    +++ b/app/models/concerns/enums/sbom.rb
    @@ -18,7 +18,7 @@ class Sbom
           apk: 9,
           rpm: 10,
           deb: 11,
    -      cbl_mariner: 12
    +      'cbl-mariner': 12
         }.with_indifferent_access.freeze
    
         def self.component_types
  2. Update the unit tests:

    diff --git a/spec/models/concerns/enums/sbom_spec.rb b/spec/models/concerns/enums/sbom_spec.rb
    index 41670880630f..e5691505154e 100644
    --- a/spec/models/concerns/enums/sbom_spec.rb
    +++ b/spec/models/concerns/enums/sbom_spec.rb
    @@ -22,7 +22,7 @@
           :apk                  | 9
           :rpm                  | 10
           :deb                  | 11
    -      :cbl_mariner          | 12
    +      'cbl-mariner'         | 12
           'unknown-pkg-manager' | 0
           'Python (unknown)'    | 0
         end
Edited by Adam Cohen