fix: invalid cpe generated (fixes #11)

anthonyharrison · Jan 3, 2024 · c346369 · c346369
1 parent 8a623d5
commit c346369
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 4 deletions.
diff --git a/distro2sbom/distrobuilder/dpkgbuilder.py b/distro2sbom/distrobuilder/dpkgbuilder.py
@@ -200,10 +200,11 @@ def process_package(self, package_name, parent="-"):
             )
             if len(supplier) > 1:
                 component_supplier = self.format_supplier(supplier, include_email=False)
+                cpe_version = version.replace(':','\\:')
                 self.sbom_package.set_externalreference(
                     "SECURITY",
                     "cpe23Type",
-                    f"cpe:2.3:a:{component_supplier.replace(' ', '_').lower()}:{package}:{version}:*:*:*:*:*:*:*",
+                    f"cpe:2.3:a:{component_supplier.replace(' ', '_').lower()}:{package}:{cpe_version}:*:*:*:*:*:*:*",
                 )
             # Store package data
             self.sbom_packages[

diff --git a/distro2sbom/distrobuilder/rpmbuilder.py b/distro2sbom/distrobuilder/rpmbuilder.py
@@ -210,10 +210,11 @@ def process_package(self, package_name, parent="-"):
             )
             if len(supplier) > 1:
                 component_supplier = self.format_supplier(supplier, include_email=False)
+                cpe_version = version.replace(':','\\:')
                 self.sbom_package.set_externalreference(
                     "SECURITY",
                     "cpe23Type",
-                    f"cpe:2.3:a:{component_supplier.replace(' ', '_').lower()}:{package}:{version}:*:*:*:*:*:*:*",
+                    f"cpe:2.3:a:{component_supplier.replace(' ', '_').lower()}:{package}:{cpe_version}:*:*:*:*:*:*:*",
                 )
             # Store package data
             self.sbom_packages[

diff --git a/distro2sbom/version.py b/distro2sbom/version.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2023 Anthony Harrison
+# Copyright (C) 2024 Anthony Harrison
 # SPDX-License-Identifier: Apache-2.0
 
-VERSION: str = "0.4.1"
+VERSION: str = "0.4.2"