Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(sbom): export bom-ref when converting a package to a component #7340

Merged
merged 18 commits into from
Sep 19, 2024
Merged

fix(sbom): export bom-ref when converting a package to a component #7340

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
73a0018
fix(sbom): export bom-ref
afdesk Aug 14, 2024
f22f6b4
fix tests
afdesk Aug 14, 2024
0eebb2a
remove file path
Aug 15, 2024
46e10ac
add test case
afdesk Aug 17, 2024
5cb120b
fix: update test data
afdesk Aug 21, 2024
4e42d28
test: keep the same uid
afdesk Aug 29, 2024
61486f3
fix: keep existing BOM-ref
afdesk Aug 30, 2024
6067d5f
add: a check
afdesk Aug 30, 2024
0a5090f
refactor: look for SBOM ref only for Os and App layers
afdesk Aug 30, 2024
eaaf98b
refactor
afdesk Aug 30, 2024
418100c
refactor: reuse the parsed SBOM
knqyf263 Sep 13, 2024
0bb6387
test: add appropriate parsed BOMs
knqyf263 Sep 13, 2024
8b33309
fix: linter error
knqyf263 Sep 13, 2024
67961d7
refactor: rename AddVulnerabilities to SetVulnerabilities
knqyf263 Sep 16, 2024
13b0ff4
Revert "refactor: rename AddVulnerabilities to SetVulnerabilities"
knqyf263 Sep 18, 2024
e67a91e
Revert "fix: linter error"
knqyf263 Sep 18, 2024
28c45d8
Revert "test: add appropriate parsed BOMs"
knqyf263 Sep 18, 2024
f4478c0
Revert "refactor: reuse the parsed SBOM"
knqyf263 Sep 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion integration/integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,6 @@ func readCycloneDX(t *testing.T, filePath string) *cdx.BOM {
return (*bom.Components)[i].Name < (*bom.Components)[j].Name
})
for i := range *bom.Components {
(*bom.Components)[i].BOMRef = ""
sort.Slice(*(*bom.Components)[i].Properties, func(ii, jj int) bool {
return (*(*bom.Components)[i].Properties)[ii].Name < (*(*bom.Components)[i].Properties)[jj].Name
})
Expand Down
12 changes: 12 additions & 0 deletions integration/sbom_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ func TestSBOM(t *testing.T) {
name string
args args
golden string
fakeUUID string
override OverrideFunc
}{
{
Expand Down Expand Up @@ -57,6 +58,16 @@ func TestSBOM(t *testing.T) {
},
golden: "testdata/fluentd-multiple-lockfiles.json.golden",
},
{
name: "scan CycloneDX into CycloneDX",
args: args{
input: "testdata/fixtures/sbom/fluentd-multiple-lockfiles-cyclonedx.json",
format: "cyclonedx",
artifactType: "cyclonedx",
},
fakeUUID: "3ff14136-e09f-4df9-80ea-%012d",
golden: "testdata/fluentd-multiple-lockfiles-reused.cdx.json.golden",
},
{
name: "minikube KBOM",
args: args{
Expand Down Expand Up @@ -165,6 +176,7 @@ func TestSBOM(t *testing.T) {
// Run "trivy sbom"
runTest(t, osArgs, tt.golden, outputFile, types.Format(tt.args.format), runOptions{
override: overrideFuncs(overrideSBOMReport, overrideUID, tt.override),
fakeUUID: tt.fakeUUID,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like we only use fakeUUID for serialNumber:

trivy/integration/testdata/fluentd-multiple-lockfiles-reused.cdx.json.golden

Line 5 in 8b33309

"serialNumber": "urn:uuid:3ff14136-e09f-4df9-80ea-000000000006",

This might be confusing (that we don't overwrite other UUID's).
Maybe we just don't check serialNumber?
@knqyf263 @afdesk wdyt?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The serial number is generated by UUID. I think it's better to confirm it is generated as expected rather than ignoring it.

})
})
}
Expand Down
6 changes: 3 additions & 3 deletions integration/testdata/fixtures/sbom/fluentd-multiple-lockfiles-cyclonedx.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@
]
},
{
"bom-ref": "pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec",
"bom-ref": "179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b",
"type": "library",
"name": "activesupport",
"version": "6.0.2.1",
Expand Down Expand Up @@ -163,8 +163,8 @@
{
"ref": "95de56ee-980c-413d-8f68-6c674dc3e9d1",
"dependsOn": [
"353f2470-9c8b-4647-9d0d-96d893838dc8",
"pkg:gem/[email protected]?file_path=var%2Flib%2Fgems%2F2.5.0%2Fspecifications%2Factivesupport-6.0.2.1.gemspec"
"179eaea5-d48e-4dd3-a53d-c87c3f6e9e5b",
"353f2470-9c8b-4647-9d0d-96d893838dc8"
]
}
]
Expand Down
Loading