example: fix npm-lock

Signed-off-by: CrazyMax <[email protected]>
docker · Dec 10, 2024 · 125506b · 125506b
1 parent 18d6278
commit 125506b
Show file tree

Hide file tree

Showing 7 changed files with 36 additions and 20 deletions.
diff --git a/examples/npm-lock/.dockerignore b/examples/npm-lock/.dockerignore
@@ -1 +1,2 @@
-/build/
+/build/
+/node_modules/
diff --git a/examples/npm-lock/.gitignore b/examples/npm-lock/.gitignore
@@ -0,0 +1 @@
+node_modules
diff --git a/examples/npm-lock/Dockerfile b/examples/npm-lock/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-# Copyright 2022 buildkit-syft-scanner authors
+# Copyright 2024 buildkit-syft-scanner authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,6 +14,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM scratch
+FROM scratch AS base
+COPY package-lock.json .
+COPY <<EOF /empty
+EOF
 
-COPY package-lock.json /package-lock.json
+FROM scratch
+COPY --from=base /empty /
diff --git a/examples/npm-lock/checks/sbom-base.spdx.json b/examples/npm-lock/checks/sbom-base.spdx.json
@@ -0,0 +1,14 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://spdx.dev/Document",
+  "predicate": {
+    "SPDXID": "SPDXRef-DOCUMENT",
+    "name": "sbom-base",
+    "packages": [
+      {
+        "SPDXID": "=package",
+        "name": "lodash"
+      }
+    ]
+  }
+}
diff --git a/examples/npm-lock/checks/sbom.spdx.json b/examples/npm-lock/checks/sbom.spdx.json
@@ -3,16 +3,6 @@
   "predicateType": "https://spdx.dev/Document",
   "predicate": {
     "SPDXID": "SPDXRef-DOCUMENT",
-    "name": "sbom",
-    "packages": [
-      {
-        "SPDXID": "=package",
-        "name": "lodash"
-      },
-      {
-        "SPDXID": "=package",
-        "name": "npm"
-      }
-    ]
+    "name": "sbom"
   }
 }
diff --git a/examples/npm-lock/package-lock.json b/examples/npm-lock/package-lock.json
diff --git a/examples/npm-lock/package.json b/examples/npm-lock/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "npm-lock",
+  "version": "1.0.0",
+  "description": "BuildKit Syft Scanner",
+  "dependencies": {
+    "lodash": "^4.17.21"
+  }
+}