fix(sbom): skip executable file analysis if Rekor isn't a specified SBOM source (aquasecurity#6163)

otms61 · web-flow · commit 7694df11fbd0 · 2024-02-20T06:44:35.000Z
diff --git a/pkg/commands/artifact/run.go b/pkg/commands/artifact/run.go
@@ -514,7 +514,8 @@ func disabledAnalyzers(opts flag.Options) []analyzer.Type {
 		analyzers = append(analyzers, analyzer.TypeHistoryDockerfile)
 	}
 
-	if len(opts.SBOMSources) == 0 {
+	// Skip executable file analysis if Rekor isn't a specified SBOM source.
+	if !slices.Contains(opts.SBOMSources, types.SBOMSourceRekor) {
 		analyzers = append(analyzers, analyzer.TypeExecutable)
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -514,7 +514,8 @@ func disabledAnalyzers(opts flag.Options) []analyzer.Type {`
`514`	`514`	`analyzers = append(analyzers, analyzer.TypeHistoryDockerfile)`
`515`	`515`	`}`
`516`	`516`
`517`		`- if len(opts.SBOMSources) == 0 {`
	`517`	`+ // Skip executable file analysis if Rekor isn't a specified SBOM source.`
	`518`	`+ if !slices.Contains(opts.SBOMSources, types.SBOMSourceRekor) {`
`518`	`519`	`analyzers = append(analyzers, analyzer.TypeExecutable)`
`519`	`520`	`}`
`520`	`521`