fix: make a purl DT can recognize, add CPE by djcrabhat · Pull Request #57 · CycloneDX/cyclonedx-linux-generator

djcrabhat · 2022-09-04T04:17:48Z

Make the purl that is output align with what DependencyTrack expects. I understand this could potentially be breaking for those who expect the purl to be where the package was downloaded from. Added a details map Download-Url key for that old value.

Reference: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#rpm

But I know that purl's don't seem that well supported for OS packages. So I'm also adding CPEs for RedHat. (I'm gonna trick DependencyTrack in to recognizing vulnerable packages, if by hook or by crook! 😆)

Closes #11

sonatype-lift · 2022-09-04T04:22:04Z

+            }
+
+			try {
+				String downloadUrl = getPackageDownloadUrl(software);


SHELL_INJECTION: UserControlledString(BufferedReader.readLine()) in procedure UnixSBomGenerator.processListCmdOutput(...) at line 438 ~> ShellExec(ProcessBuilder.command(...)) in procedure RedHatSBomGenerator.getPackageDownloadUrl(...) at line 185.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2022-09-04T21:14:34Z

 	 * 
+	 *
+	 * @param url
+	 * @param name


💬 3 similar findings have been found in this PR

EmptyBlockTag: A block tag (@param, @return, @throws, @deprecated) has an empty description. Block tags without descriptions don't add much value for future readers of the code; consider removing the tag entirely or adding a description.

Suggested change

* @param name

*

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 327

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 324

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 326

Visit the Lift Web Console to find more details in your report.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2022-09-04T21:14:35Z

+        return bom;
+    }
+
+	private String getCpe(String software, String version) {


💬 6 similar findings have been found in this PR

UnusedVariable: The parameter 'version' is never read.

Suggested change

private String getCpe(String software, String version) {

cpe = getCpe(software);

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 333

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 333

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 333

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/RedHatSBomGenerator.java 115

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 333

src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java 333

Visit the Lift Web Console to find more details in your report.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

…enerator/RedHatSBomGenerator.java Co-authored-by: sonatype-lift[bot] <37194012+sonatype-lift[bot]@users.noreply.github.com> Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

stephan-wolf-ais · 2023-04-27T13:45:04Z

Can somebody merge this PR please?

sonatype-lift Bot reviewed Sep 4, 2022

View reviewed changes

Comment thread src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/RedHatSBomGenerator.java Outdated

sonatype-lift Bot reviewed Sep 4, 2022

View reviewed changes

djcrabhat force-pushed the feature/make-standard-purl branch 2 times, most recently from 614d963 to c9a8d29 Compare September 4, 2022 21:12

sonatype-lift Bot reviewed Sep 4, 2022

View reviewed changes

djcrabhat force-pushed the feature/make-standard-purl branch from 54abff6 to dbf5b28 Compare September 4, 2022 21:59

djcrabhat changed the title ~~fix: make a purl DT can recognize~~ fix: make a purl DT can recognize, add CPE Sep 4, 2022

djcrabhat and others added 13 commits September 4, 2022 17:11

fix: make a purl DT can recognize

2b923e0

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

add artifact to maven build

032278a

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

use PackageUrl class

d5cc53a

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

fix tests

d9c226d

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

add download_url detail

b351028

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

try parsing component

ab5f1a8

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

Update src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/g…

0dd331d

…enerator/RedHatSBomGenerator.java Co-authored-by: sonatype-lift[bot] <37194012+sonatype-lift[bot]@users.noreply.github.com> Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

cleanup, make purl sonatype expects

b0484da

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

set CPE of master OS component

5be1a1f

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

carve out cpe

f18951a

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

add cpe for redhat packages

66158ba

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

* vendor

d9a651b

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

go back to repeating package name

15970d1

Signed-off-by: djcrabhat <djcrabhat@sosimplerecords.com>

djcrabhat force-pushed the feature/make-standard-purl branch from 2fd70ce to 15970d1 Compare September 5, 2022 00:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: make a purl DT can recognize, add CPE#57

fix: make a purl DT can recognize, add CPE#57
djcrabhat wants to merge 13 commits intoCycloneDX:mainfrom
djcrabhat:feature/make-standard-purl

djcrabhat commented Sep 4, 2022 •

edited

Loading

Uh oh!

Uh oh!

sonatype-lift Bot Sep 4, 2022

Uh oh!

sonatype-lift Bot Sep 4, 2022

Uh oh!

sonatype-lift Bot Sep 4, 2022

Uh oh!

stephan-wolf-ais commented Apr 27, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

File Path	Line Number
src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java	327
src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java	324
src/main/java/org/cyclonedx/contrib/com/lmco/efoss/unix/sbom/generator/SBomGenerator.java	326

	private String getCpe(String software, String version) {
	cpe = getCpe(software);

Uh oh!

Conversation

djcrabhat commented Sep 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

sonatype-lift Bot Sep 4, 2022

Choose a reason for hiding this comment

Uh oh!

sonatype-lift Bot Sep 4, 2022

Choose a reason for hiding this comment

Uh oh!

sonatype-lift Bot Sep 4, 2022

Choose a reason for hiding this comment

Uh oh!

stephan-wolf-ais commented Apr 27, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

djcrabhat commented Sep 4, 2022 •

edited

Loading