Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add purls in sarif report #2254

Merged
merged 6 commits into from
Dec 4, 2024
Merged

Add purls in sarif report #2254

merged 6 commits into from
Dec 4, 2024

Conversation

GeorgeLS
Copy link
Contributor

Hello there!
Seems like that purls are missing from Sarif reports of grype.
I attempted adding those in the Sarif report. In order to do that I had to copy the deriveBomRef function that is being used in CycloneDx as well.
I tried making deriveBomRef a member function of Package type in order to avoid duplication but I couldn't build the project locally.

Thanks,
George

Signed-off-by: George Liontos <george.liontos@forallsecure.com>
GeorgeLS and others added 2 commits November 20, 2024 14:04
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
@GeorgeLS GeorgeLS requested a review from kzantow November 25, 2024 12:27
Copy link
Contributor

@kzantow kzantow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks really close -- is there a possibility of getting a test added to validate that Syft is properly outputting this purls field? I can look at adding a test, but it will be at least a few days before I can get to it. A quick look makes me think we could adjust the packages returned here to include a specific one with a PURL

Comment on lines 128 to 130
if len(m.Package.PURL) != 0 {
descriptor.Properties["purls"] = [...]string{m.Package.PURL}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Idiomatic go would probably look like this (note changing from declaring an array: [...] to a slice: []):

			if m.Package.PURL != "" {
				descriptor.Properties["purls"] = []string{m.Package.PURL}
			}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again, thanks a lot for the review and your time.
Sorry for the back and forth but I'm not a golang programmer.
I will add a test and update the code.

GeorgeLS and others added 2 commits December 4, 2024 15:10
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
@GeorgeLS GeorgeLS requested a review from kzantow December 4, 2024 13:51
Copy link
Contributor

@kzantow kzantow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM -- thanks for the updates @GeorgeLS!

@kzantow kzantow merged commit 851a5e0 into anchore:main Dec 4, 2024
10 checks passed
@willmurphyscode willmurphyscode linked an issue Dec 6, 2024 that may be closed by this pull request
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add missing package information for Sarif report
2 participants