fix(cyclonedx): set original names for packages (#4306)

aquasecurity · May 23, 2023 · 3f0721f · 3f0721f
1 parent 0ef0dad
commit 3f0721f
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/sbom/cyclonedx/unmarshal.go b/pkg/sbom/cyclonedx/unmarshal.go
@@ -341,6 +341,9 @@ func toPackage(component cdx.Component) (bool, string, *ftypes.Package, error) {
 	}
 
 	pkg := p.Package()
+	// Trivy's marshall loses case-sensitivity in PURL used in SBOM for packages (Go, Npm, PyPI),
+	// so we have to use an original package name
+	pkg.Name = component.Name
 	pkg.Ref = component.BOMRef
 
 	for _, license := range lo.FromPtr(component.Licenses) {