fix(sbom): don't overwrite srcEpoch when decoding SBOM files [backp…

…ort: release/v0.52] (#6881) Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>
aquasecurity · Jun 7, 2024 · f186d22 · f186d22
1 parent 093c0ae
commit f186d22
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pkg/sbom/io/decode.go b/pkg/sbom/io/decode.go
@@ -271,6 +271,11 @@ func (m *Decoder) fillSrcPkg(c *core.Component, pkg *ftypes.Package) {
 	}
 	m.parseSrcVersion(pkg, c.SrcVersion)
 
+	// Source info was added from component or properties
+	if pkg.SrcName != "" && pkg.SrcVersion != "" {
+		return
+	}
+
 	// Fill source package information for components in third-party SBOMs .
 	if pkg.SrcName == "" {
 		pkg.SrcName = pkg.Name