Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(sbom): use group field for jar in cyclonedx #4674

Merged
merged 1 commit into from
Jun 22, 2023
Merged

feat(sbom): use group field for jar in cyclonedx #4674

merged 1 commit into from
Jun 22, 2023

Conversation

DmitriyLewen
Copy link
Contributor

@DmitriyLewen DmitriyLewen commented Jun 20, 2023 •
edited
Loading

Description

Maven and Gradle CycloneDX plugins use Group field for GroupID.
#4669
#4635

We need to add support of this case.
Also split GroupID and ArtifactID by group and name fields.

Related Issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@DmitriyLewen DmitriyLewen self-assigned this Jun 20, 2023
@DmitriyLewen DmitriyLewen marked this pull request as ready for review June 20, 2023 05:44
knqyf263
knqyf263 reviewed Jun 20, 2023
View reviewed changes
pkg/sbom/cyclonedx/unmarshal.go
Comment on lines +411 to +417
func getPackageName(typ string, component cdx.Component) string {
// Jar uses `Group` field for `GroupID`
if typ == packageurl.TypeMaven && component.Group != "" {
return fmt.Sprintf("%s:%s", component.Group, component.Name)
}
return component.Name
}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it should be done here. What do you think?

trivy/pkg/purl/purl.go

Lines 73 to 85 in df61fd4

if p.Type == packageurl.TypeMaven || p.Type == ftypes.Gradle {
// Maven and Gradle packages separate ":"
// e.g. org.springframework:spring-core
pkg.Name = strings.Join([]string{
p.Namespace,
p.Name,
}, ":")
} else {
pkg.Name = strings.Join([]string{
p.Namespace,
p.Name,
}, "/")
}

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or is PURL missing groupID?

Copy link
Contributor Author

@DmitriyLewen DmitriyLewen Jun 20, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we use component.Name after this PR - https://github.com/aquasecurity/trivy/pull/4306/files#diff-caf585364b1a95f5cb5dbda210a5ca931fad058915ba586540c8aa32a7883311R346

But maybe it's better to use the purl name for jars. Wdyt?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, I just remember the change. OK, so we can go with your change.

@knqyf263 knqyf263 added this pull request to the merge queue Jun 22, 2023
Merged via the queue into aquasecurity:main with commit 5ccee14 Jun 22, 2023
@DmitriyLewen DmitriyLewen deleted the feat/cyclonedx-jar-group branch June 22, 2023 07:43
AnaisUrlichs pushed a commit to AnaisUrlichs/trivy that referenced this pull request Aug 10, 2023
@DmitriyLewen @AnaisUrlichs
use group field for jar in cyclonedx (aquasecurity#4674)
f802629
@DmitriyLewen DmitriyLewen mentioned this pull request Sep 18, 2023
Merged
4 tasks
@DmitriyLewen DmitriyLewen mentioned this pull request Jan 11, 2024
Merged
7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@knqyf263 knqyf263 knqyf263 approved these changes

Assignees

@DmitriyLewen DmitriyLewen

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

use Group field for jar in Cyclonedx
2 participants
@DmitriyLewen @knqyf263