[ISV-5787] Remove child digests from externalRefs

Author: mavaras

sbom-utility-scripts/scripts/index-image-sbom-script/index_image_sbom_script.py

@@ -55,31 +55,36 @@ def digest_hex_val(self) -> str:
         _, val = self.digest.split(":")
         return val
 
-    def purls(self, index_digest: Optional[str] = None) -> list[str]:
-        ans = []
-        if index_digest and self.arch:
-            ans.append(
-                PackageURL(
-                    type="oci",
-                    name=self.name,
-                    version=index_digest,
-                    qualifiers={"arch": self.arch, "repository_url": self.repository},
-                ).to_string()
-            )
-        ans.append(
-            PackageURL(
-                type="oci",
-                name=self.name,
-                version=self.digest,
-                qualifiers={"repository_url": self.repository},
-            ).to_string()
-        )
-        return ans
+    def purls(self, index_digest: str) -> list[str]:
+        purl = PackageURL(
+            type="oci",
+            name=self.name,
+            version=index_digest,
+            qualifiers={"arch": self.arch, "repository_url": self.repository},
+        ).to_string()
+
+        # HACK: There's a bug in PackageURL python that incorrectly handles
+        # encoding of ':' characters.  When this PR is merged, the hack should be
+        # removed: https://github.com/package-url/packageurl-python/pull/178
+        return [self._hack_purl_encoding(purl)]
 
     def propose_spdx_id(self) -> str:
         purl_hex_digest = hashlib.sha256(self.purls()[0].encode()).hexdigest()
         return f"SPDXRef-image-{self.name}-{purl_hex_digest}"
 
+    def _hack_purl_encoding(purl: str) -> str:
+        """
+        Encode ':' characters in PURL that are not the scheme and type separator.
+        """
+        if purl.count(":") == 1:
+            return purl
+
+        first_idx = purl.find(":")
+        after_first = purl[first_idx + 1 :]
+        after_first = after_first.replace(":", "%3A")
+
+        return f"{purl[:first_idx]}:{after_first}"
+
 
 def create_package(image: Image, spdxid: Optional[str] = None, image_index_digest: Optional[str] = None) -> dict:
     return {

sbom-utility-scripts/scripts/index-image-sbom-script/test_image_index_sbom_script.py

@@ -118,11 +118,6 @@
                                 "referenceType": "purl",
                                 "referenceLocator": "pkg:oci/ubi9-micro-container@sha256:1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=ppc64le&repository_url=quay.io/ubi9-micro-container",
                             },
-                            {
-                                "referenceCategory": "PACKAGE-MANAGER",
-                                "referenceType": "purl",
-                                "referenceLocator": "pkg:oci/ubi9-micro-container@sha256:f08722139c4da653b870272a192fac700960a3315baa1f79f83a4712a436d4?repository_url=quay.io/ubi9-micro-container",
-                            },
                         ],
                         "checksums": [
                             {
@@ -251,11 +246,6 @@ def test_main(
                             "referenceType": "purl",
                             "referenceLocator": "pkg:oci/bar@sha256:456?arch=arm64&repository_url=quay.io/foo/bar",
                         },
-                        {
-                            "referenceCategory": "PACKAGE-MANAGER",
-                            "referenceType": "purl",
-                            "referenceLocator": "pkg:oci/bar@sha256:123?repository_url=quay.io/foo/bar",
-                        },
                     ],
                     "checksums": [{"algorithm": "SHA256", "checksumValue": "123"}],
                 },