fix: SBOM multi-ecosystem support with correct package managers and licenses #8

Merged

sharang merged 2 commits from fix/sbom-package-manager-from-purl into main 2026-03-10 12:37:30 +00:00

Conversation 0 Commits 2 Files Changed 7 +340 -28

sharang commented 2026-03-10 11:50:47 +00:00

Owner

Copy Link

Summary

• Package manager detection: Extract ecosystem from PURL (pkg:npm/... → npm, pkg:cargo/... → cargo) instead of using CycloneDX type field which was returning "library"/"file" for everything
• Lock file generation: Auto-generate Cargo.lock, package-lock.json, and requirements.txt before Syft scan for repos that gitignore their lock files
• License resolution: Enable Syft remote license lookups for Go/JS/Python/Java, enrich Cargo via cargo metadata, and parse SPDX license expressions
• Dynamic filter dropdowns: Manager and license dropdowns now populate from actual DB data via new /api/v1/sbom/filters endpoint
• Stale entry cleanup: Delete old SBOM entries on rescan instead of only upserting, so removed dependencies don't linger
• Docker image: Added cargo, npm, go, php, ruby, composer, bundler for lockfile generation in production

Test plan

• Rescan a Rust repo — should see cargo packages with licenses
• Rescan an npm repo — manager should show "npm" not "library"
• Add Python/Go/Java/PHP/Ruby repos and scan — verify correct managers and licenses
• Verify manager and license dropdowns populate dynamically
• Filter by manager and license — should return correct results

🤖 Generated with Claude Code

## Summary - **Package manager detection**: Extract ecosystem from PURL (`pkg:npm/...` → npm, `pkg:cargo/...` → cargo) instead of using CycloneDX `type` field which was returning "library"/"file" for everything - **Lock file generation**: Auto-generate `Cargo.lock`, `package-lock.json`, and `requirements.txt` before Syft scan for repos that gitignore their lock files - **License resolution**: Enable Syft remote license lookups for Go/JS/Python/Java, enrich Cargo via `cargo metadata`, and parse SPDX license expressions - **Dynamic filter dropdowns**: Manager and license dropdowns now populate from actual DB data via new `/api/v1/sbom/filters` endpoint - **Stale entry cleanup**: Delete old SBOM entries on rescan instead of only upserting, so removed dependencies don't linger - **Docker image**: Added cargo, npm, go, php, ruby, composer, bundler for lockfile generation in production ## Test plan - [x] Rescan a Rust repo — should see cargo packages with licenses - [x] Rescan an npm repo — manager should show "npm" not "library" - [x] Add Python/Go/Java/PHP/Ruby repos and scan — verify correct managers and licenses - [x] Verify manager and license dropdowns populate dynamically - [x] Filter by manager and license — should return correct results 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-03-10 11:50:47 +00:00

fix: SBOM multi-ecosystem support with correct package managers and licenses ... 9da1d057d5

- Extract package manager from PURL instead of CycloneDX component type
  (was showing "library"/"file" instead of "npm"/"cargo"/"pip" etc.)
- Generate missing lock files (Cargo.lock, package-lock.json) before Syft
  scan so repos that gitignore them still get full dependency trees
- Enable Syft remote license lookups for Go, JS, Python, and Java
- Enrich Cargo entries with license data from cargo metadata
- Parse CycloneDX license expressions (e.g. "MIT OR Apache-2.0")
- Delete stale SBOM entries on rescan instead of only upserting
- Add /api/v1/sbom/filters endpoint for dynamic filter options
- Make manager and license dropdowns dynamic from actual DB data
- Add cargo, npm, go, php, ruby, composer, bundler to Docker image

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sharang added 1 commit 2026-03-10 12:22:04 +00:00

style: apply cargo fmt ... 1d861ef8fc

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sharang merged commit daff5812a6 into main 2026-03-10 12:37:30 +00:00

sharang deleted branch fix/sbom-package-manager-from-purl 2026-03-10 12:37:30 +00:00

sharang referenced this issue from a commit 2026-03-10 12:37:31 +00:00

fix: SBOM multi-ecosystem support with correct package managers and licenses (#8)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

critical

enhancement

high

infrastructure

performance

security

v0.3.0

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

sharang

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#8