mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 14:06:50 +01:00
Garry Tan
10315cf44d
* v1.91.27.0 fix(cso): package-level signed SBOMs and staged probes in the verifier container * Qualified scanner catalogs persist scan outcomes; catalog-state tests hold for either state; SBOM tests live with their owner
8 lines
464 B
Plaintext
8 lines
464 B
Plaintext
# Accept only a package-level SPDX 2.3 document whose relationships name known elements.
|
|
.spdxVersion == "SPDX-2.3"
|
|
and (.packages | type == "array" and length > 0)
|
|
and (has("files") | not)
|
|
and (([.SPDXID, .packages[].SPDXID] | map({key: ., value: true}) | from_entries) as $known
|
|
| all(.relationships[]; ($known[.spdxElementId] // false)
|
|
and (($known[.relatedSpdxElement] // false) or (.relatedSpdxElement | test("^(NONE|NOASSERTION)$|^DocumentRef-")))))
|