fix: analysis of an empty manifest returns non-zero scanned deps (guacsec#422)

fix: analysis of an empty go manifest returns non-zero scanned depenedencies

Author: a-oren

src/cyclone_dx_sbom.js

@@ -149,6 +149,7 @@ export default class CycloneDxSbom {
 	getAsJsonString(opts) {
 		let manifestType = opts["manifest-type"]
 		this.setSourceManifest(opts["source-manifest"])
+		const rootPurl = this.rootComponent?.purl;
 		this.sbomObject = {
 			"bomFormat": "CycloneDX",
 			"specVersion": "1.4",
@@ -158,7 +159,7 @@ export default class CycloneDxSbom {
 				"component": this.rootComponent,
 				"properties": new Array()
 			},
-			"components": this.components,
+			"components": this.components.filter(c => c.purl !== rootPurl),
 			"dependencies": this.dependencies
 		}
 		if (this.rootComponent === undefined)

test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_component_analysis.json

@@ -13,13 +13,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0"
-        },
         {
             "name": "serde",
             "version": "1.0.193",

test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_stack_analysis.json

@@ -13,13 +13,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0"
-        },
         {
             "name": "serde",
             "version": "1.0.193",

test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_component_analysis.json

@@ -13,13 +13,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0"
-        },
         {
             "name": "tokio",
             "version": "1.35.0",

test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_stack_analysis.json

@@ -13,13 +13,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0"
-        },
         {
             "name": "tokio",
             "version": "1.35.0",

test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_component_analysis.json

@@ -13,13 +13,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0"
-        },
         {
             "name": "tokio",
             "version": "1.35.0",

test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_stack_analysis.json

@@ -13,13 +13,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0"
-        },
         {
             "name": "tokio",
             "version": "1.35.0",

test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_component_analysis.json

@@ -20,20 +20,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0",
-            "licenses": [
-                {
-                    "license": {
-                        "id": "ISC"
-                    }
-                }
-            ]
-        },
         {
             "name": "serde",
             "version": "1.0.193",

test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_stack_analysis.json

@@ -20,20 +20,6 @@
         }
     },
     "components": [
-        {
-            "name": "my-test-crate",
-            "version": "0.1.0",
-            "purl": "pkg:cargo/my-test-crate@0.1.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/my-test-crate@0.1.0",
-            "licenses": [
-                {
-                    "license": {
-                        "id": "ISC"
-                    }
-                }
-            ]
-        },
         {
             "name": "serde",
             "version": "1.0.193",

test/providers/tst_manifests/cargo/cargo_virtual_workspace/expected_sbom_component_analysis.json

@@ -12,14 +12,6 @@
             "bom-ref": "pkg:cargo/cargo_virtual_workspace@0.0.0"
         }
     },
-    "components": [
-        {
-            "name": "cargo_virtual_workspace",
-            "version": "0.0.0",
-            "purl": "pkg:cargo/cargo_virtual_workspace@0.0.0",
-            "type": "application",
-            "bom-ref": "pkg:cargo/cargo_virtual_workspace@0.0.0"
-        }
-    ],
+    "components": [],
     "dependencies": []
 }