fix: Don't use the actual redis or grpc CPEs for gems (#1926)

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>
anchore · Jul 10, 2023 · c0c089f · c0c089f
1 parent 376c428
commit c0c089f
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/syft/pkg/cataloger/common/cpe/candidate_by_package_type.go b/syft/pkg/cataloger/common/cpe/candidate_by_package_type.go
@@ -461,6 +461,17 @@ var defaultCandidateRemovals = buildCandidateRemovalLookup(
 				VendorsToRemove:  []string{"gradle"},
 			},
 		},
+		// Ruby packages
+		{
+			pkg.GemPkg,
+			candidateKey{PkgName: "redis"},
+			candidateRemovals{ProductsToRemove: []string{"redis"}},
+		},
+		{
+			pkg.GemPkg,
+			candidateKey{PkgName: "grpc"},
+			candidateRemovals{ProductsToRemove: []string{"grpc"}},
+		},
 	})
 
 // buildCandidateLookup is a convenience function for creating the defaultCandidateAdditions set