fix(bitnami): use purl
to detect bitnami
pkg name
#6981
Labels
scan/sbom
Issues relating to SBOM
scan/vulnerability
Issues relating to vulnerability scanning
triage/support
Indicates an issue that is a support question.
Description
We use package name field instead of purl to detect package name to avoid case-insensitive issues:
trivy/pkg/sbom/io/decode.go
Lines 249 to 266 in c3192f0
But
bitnami
is more focused onpurl
.So After discussion we decided to use
purl
forbitnami
packages.See #6954 (reply in thread)
Discussed in #6954
The text was updated successfully, but these errors were encountered: