-
Notifications
You must be signed in to change notification settings - Fork 600
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add purls in sarif report #2254
Conversation
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks really close -- is there a possibility of getting a test added to validate that Syft is properly outputting this purls
field? I can look at adding a test, but it will be at least a few days before I can get to it. A quick look makes me think we could adjust the packages returned here to include a specific one with a PURL
grype/presenter/sarif/presenter.go
Outdated
if len(m.Package.PURL) != 0 { | ||
descriptor.Properties["purls"] = [...]string{m.Package.PURL} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Idiomatic go
would probably look like this (note changing from declaring an array: [...]
to a slice: []
):
if m.Package.PURL != "" {
descriptor.Properties["purls"] = []string{m.Package.PURL}
}
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Again, thanks a lot for the review and your time.
Sorry for the back and forth but I'm not a golang programmer.
I will add a test and update the code.
Signed-off-by: George Liontos <george.liontos@forallsecure.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM -- thanks for the updates @GeorgeLS!
Hello there!
Seems like that
purls
are missing from Sarif reports ofgrype
.I attempted adding those in the Sarif report. In order to do that I had to copy the
deriveBomRef
function that is being used in CycloneDx as well.I tried making
deriveBomRef
a member function ofPackage
type in order to avoid duplication but I couldn't build the project locally.Thanks,
George