Skip to content

Commit ab74caa

Browse files
knqyf263DmitriyLewen
knqyf263
and
DmitriyLewen
authored
refactor(sbom): use intermediate representation for SPDX (#6310)
Signed-off-by: knqyf263 <[email protected]> Co-authored-by: DmitriyLewen <[email protected]>
1 parent 71da44f commit ab74caa

21 files changed

+1041
-875
lines changed

‎integration/testdata/conda-spdx.json.golden

+16-23
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"dataLicense": "CC0-1.0",
44
"SPDXID": "SPDXRef-DOCUMENT",
55
"name": "testdata/fixtures/repo/conda",
6-
"documentNamespace": "http://aquasecurity.github.io/trivy/filesystem/testdata/fixtures/repo/conda-3ff14136-e09f-4df9-80ea-000000000001",
6+
"documentNamespace": "http://aquasecurity.github.io/trivy/filesystem/testdata/fixtures/repo/conda-3ff14136-e09f-4df9-80ea-000000000004",
77
"creationInfo": {
88
"creators": [
99
"Organization: aquasecurity",
@@ -12,17 +12,9 @@
1212
"created": "2021-08-25T12:20:30Z"
1313
},
1414
"packages": [
15-
{
16-
"name": "conda-pkg",
17-
"SPDXID": "SPDXRef-Application-ee5ef1aa4ac89125",
18-
"downloadLocation": "NONE",
19-
"filesAnalyzed": false,
20-
"sourceInfo": "Conda",
21-
"primaryPackagePurpose": "APPLICATION"
22-
},
2315
{
2416
"name": "openssl",
25-
"SPDXID": "SPDXRef-Package-20b95c21bfbf9fc4",
17+
"SPDXID": "SPDXRef-Package-b8061a5279413d55",
2618
"versionInfo": "1.1.1q",
2719
"supplier": "NOASSERTION",
2820
"downloadLocation": "NONE",
@@ -39,11 +31,14 @@
3931
"referenceLocator": "pkg:conda/[email protected]"
4032
}
4133
],
34+
"attributionTexts": [
35+
"PkgType: conda-pkg"
36+
],
4237
"primaryPackagePurpose": "LIBRARY"
4338
},
4439
{
4540
"name": "pip",
46-
"SPDXID": "SPDXRef-Package-11a429ec3bd01d80",
41+
"SPDXID": "SPDXRef-Package-84198b3828050c11",
4742
"versionInfo": "22.2.2",
4843
"supplier": "NOASSERTION",
4944
"downloadLocation": "NONE",
@@ -60,6 +55,9 @@
6055
"referenceLocator": "pkg:conda/[email protected]"
6156
}
6257
],
58+
"attributionTexts": [
59+
"PkgType: conda-pkg"
60+
],
6361
"primaryPackagePurpose": "LIBRARY"
6462
},
6563
{
@@ -105,27 +103,22 @@
105103
},
106104
{
107105
"spdxElementId": "SPDXRef-Filesystem-2e2426fd0f2580ef",
108-
"relatedSpdxElement": "SPDXRef-Application-ee5ef1aa4ac89125",
106+
"relatedSpdxElement": "SPDXRef-Package-84198b3828050c11",
109107
"relationshipType": "CONTAINS"
110108
},
111109
{
112-
"spdxElementId": "SPDXRef-Application-ee5ef1aa4ac89125",
113-
"relatedSpdxElement": "SPDXRef-Package-20b95c21bfbf9fc4",
114-
"relationshipType": "CONTAINS"
115-
},
116-
{
117-
"spdxElementId": "SPDXRef-Package-20b95c21bfbf9fc4",
118-
"relatedSpdxElement": "SPDXRef-File-600e5e0110a84891",
110+
"spdxElementId": "SPDXRef-Filesystem-2e2426fd0f2580ef",
111+
"relatedSpdxElement": "SPDXRef-Package-b8061a5279413d55",
119112
"relationshipType": "CONTAINS"
120113
},
121114
{
122-
"spdxElementId": "SPDXRef-Application-ee5ef1aa4ac89125",
123-
"relatedSpdxElement": "SPDXRef-Package-11a429ec3bd01d80",
115+
"spdxElementId": "SPDXRef-Package-84198b3828050c11",
116+
"relatedSpdxElement": "SPDXRef-File-7eb62e2a3edddc0a",
124117
"relationshipType": "CONTAINS"
125118
},
126119
{
127-
"spdxElementId": "SPDXRef-Package-11a429ec3bd01d80",
128-
"relatedSpdxElement": "SPDXRef-File-7eb62e2a3edddc0a",
120+
"spdxElementId": "SPDXRef-Package-b8061a5279413d55",
121+
"relatedSpdxElement": "SPDXRef-File-600e5e0110a84891",
129122
"relationshipType": "CONTAINS"
130123
}
131124
]

‎integration/testdata/fluentd-multiple-lockfiles.cdx.json.golden

+12-12
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@
286286
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
287287
"type": "library",
288288
"name": "bsdutils",
289-
"version": "2.33.1-0.1",
289+
"version": "1:2.33.1-0.1",
290290
"licenses": [
291291
{
292292
"license": {
@@ -628,7 +628,7 @@
628628
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
629629
"type": "library",
630630
"name": "diffutils",
631-
"version": "3.7-3",
631+
"version": "1:3.7-3",
632632
"licenses": [
633633
{
634634
"license": {
@@ -1338,7 +1338,7 @@
13381338
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
13391339
"type": "library",
13401340
"name": "libattr1",
1341-
"version": "2.4.48-4",
1341+
"version": "1:2.4.48-4",
13421342
"licenses": [
13431343
{
13441344
"license": {
@@ -1396,7 +1396,7 @@
13961396
"bom-ref": "pkg:deb/debian/[email protected]?arch=all&distro=debian-10.2&epoch=1",
13971397
"type": "library",
13981398
"name": "libaudit-common",
1399-
"version": "2.8.4-3",
1399+
"version": "1:2.8.4-3",
14001400
"licenses": [
14011401
{
14021402
"license": {
@@ -1454,7 +1454,7 @@
14541454
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
14551455
"type": "library",
14561456
"name": "libaudit1",
1457-
"version": "2.8.4-3",
1457+
"version": "1:2.8.4-3",
14581458
"licenses": [
14591459
{
14601460
"license": {
@@ -2091,7 +2091,7 @@
20912091
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
20922092
"type": "library",
20932093
"name": "libgcc1",
2094-
"version": "8.3.0-6",
2094+
"version": "1:8.3.0-6",
20952095
"purl": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
20962096
"properties": [
20972097
{
@@ -2285,7 +2285,7 @@
22852285
"bom-ref": "pkg:deb/debian/[email protected]%2Bdfsg-4?arch=amd64&distro=debian-10.2&epoch=2",
22862286
"type": "library",
22872287
"name": "libgmp10",
2288-
"version": "6.1.2+dfsg-4",
2288+
"version": "2:6.1.2+dfsg-4",
22892289
"licenses": [
22902290
{
22912291
"license": {
@@ -3286,7 +3286,7 @@
32863286
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=2",
32873287
"type": "library",
32883288
"name": "libpcre3",
3289-
"version": "8.39-12",
3289+
"version": "2:8.39-12",
32903290
"purl": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=2",
32913291
"properties": [
32923292
{
@@ -4450,7 +4450,7 @@
44504450
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
44514451
"type": "library",
44524452
"name": "login",
4453-
"version": "4.5-1.1",
4453+
"version": "1:4.5-1.1",
44544454
"licenses": [
44554455
{
44564456
"license": {
@@ -4742,7 +4742,7 @@
47424742
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
47434743
"type": "library",
47444744
"name": "passwd",
4745-
"version": "4.5-1.1",
4745+
"version": "1:4.5-1.1",
47464746
"licenses": [
47474747
{
47484748
"license": {
@@ -5338,7 +5338,7 @@
53385338
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
53395339
"type": "library",
53405340
"name": "ruby",
5341-
"version": "2.5.1",
5341+
"version": "1:2.5.1",
53425342
"licenses": [
53435343
{
53445344
"license": {
@@ -5690,7 +5690,7 @@
56905690
"bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-10.2&epoch=1",
56915691
"type": "library",
56925692
"name": "zlib1g",
5693-
"version": "1.2.11.dfsg-1",
5693+
"version": "1:1.2.11.dfsg-1",
56945694
"licenses": [
56955695
{
56965696
"license": {

‎pkg/fanal/analyzer/sbom/sbom_test.go

+19-5
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
3131
Type: types.Jar,
3232
Libraries: types.Packages{
3333
{
34+
ID: "co.elastic.apm:apm-agent:1.36.0",
3435
Name: "co.elastic.apm:apm-agent",
3536
Version: "1.36.0",
3637
FilePath: "opt/bitnami/elasticsearch",
@@ -44,6 +45,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
4445
},
4546
},
4647
{
48+
ID: "co.elastic.apm:apm-agent-cached-lookup-key:1.36.0",
4749
Name: "co.elastic.apm:apm-agent-cached-lookup-key",
4850
Version: "1.36.0",
4951
FilePath: "opt/bitnami/elasticsearch",
@@ -57,6 +59,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
5759
},
5860
},
5961
{
62+
ID: "co.elastic.apm:apm-agent-common:1.36.0",
6063
Name: "co.elastic.apm:apm-agent-common",
6164
Version: "1.36.0",
6265
FilePath: "opt/bitnami/elasticsearch",
@@ -70,6 +73,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
7073
},
7174
},
7275
{
76+
ID: "co.elastic.apm:apm-agent-core:1.36.0",
7377
Name: "co.elastic.apm:apm-agent-core",
7478
Version: "1.36.0",
7579
FilePath: "opt/bitnami/elasticsearch",
@@ -89,7 +93,8 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
8993
FilePath: "opt/bitnami/elasticsearch",
9094
Libraries: types.Packages{
9195
{
92-
Name: "elasticsearch",
96+
ID: "[email protected]",
97+
Name: "Elasticsearch",
9398
Version: "8.9.1",
9499
Arch: "arm64",
95100
Licenses: []string{"Elastic-2.0"},
@@ -169,7 +174,8 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
169174
FilePath: "opt/bitnami/postgresql",
170175
Libraries: types.Packages{
171176
{
172-
Name: "gdal",
177+
ID: "[email protected]",
178+
Name: "GDAL",
173179
Version: "3.7.1",
174180
Licenses: []string{"MIT"},
175181
Identifier: types.PkgIdentifier{
@@ -181,7 +187,8 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
181187
},
182188
},
183189
{
184-
Name: "geos",
190+
ID: "[email protected]",
191+
Name: "GEOS",
185192
Version: "3.8.3",
186193
Licenses: []string{"LGPL-2.1-only"},
187194
Identifier: types.PkgIdentifier{
@@ -193,7 +200,8 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
193200
},
194201
},
195202
{
196-
Name: "postgresql",
203+
ID: "[email protected]",
204+
Name: "PostgreSQL",
197205
Version: "15.3.0",
198206
Licenses: []string{"PostgreSQL"},
199207
Identifier: types.PkgIdentifier{
@@ -203,9 +211,15 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
203211
Version: "15.3.0",
204212
},
205213
},
214+
DependsOn: []string{
215+
"[email protected]",
216+
"[email protected]",
217+
"[email protected]",
218+
},
206219
},
207220
{
208-
Name: "proj",
221+
ID: "[email protected]",
222+
Name: "Proj",
209223
Version: "6.3.2",
210224
Licenses: []string{"MIT"},
211225
Identifier: types.PkgIdentifier{

‎pkg/fanal/applier/docker.go

+3-6
Original file line numberDiff line numberDiff line change
@@ -263,12 +263,9 @@ func newPURL(pkgType ftypes.TargetType, metadata types.Metadata, pkg ftypes.Pack
263263
func aggregate(detail *ftypes.ArtifactDetail) {
264264
var apps []ftypes.Application
265265

266-
aggregatedApps := map[ftypes.LangType]*ftypes.Application{
267-
ftypes.PythonPkg: {Type: ftypes.PythonPkg},
268-
ftypes.CondaPkg: {Type: ftypes.CondaPkg},
269-
ftypes.GemSpec: {Type: ftypes.GemSpec},
270-
ftypes.NodePkg: {Type: ftypes.NodePkg},
271-
ftypes.Jar: {Type: ftypes.Jar},
266+
aggregatedApps := make(map[ftypes.LangType]*ftypes.Application)
267+
for _, t := range ftypes.AggregatingTypes {
268+
aggregatedApps[t] = &ftypes.Application{Type: t}
272269
}
273270

274271
for _, app := range detail.Applications {

‎pkg/fanal/types/const.go

+8
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,14 @@ const (
8181
OCP LangType = "ocp" // Red Hat OpenShift Container Platform
8282
)
8383

84+
var AggregatingTypes = []LangType{
85+
PythonPkg,
86+
CondaPkg,
87+
GemSpec,
88+
NodePkg,
89+
Jar,
90+
}
91+
8492
// Config files
8593
const (
8694
JSON ConfigType = "json"

‎pkg/k8s/scanner/scanner.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -375,7 +375,9 @@ func (s *Scanner) clusterInfoToReportResources(allArtifact []*artifacts.Artifact
375375
return nil, fmt.Errorf("failed to find node name")
376376
}
377377

378-
kbom := core.NewBOM()
378+
kbom := core.NewBOM(core.Options{
379+
GenerateBOMRef: true,
380+
})
379381
for _, artifact := range allArtifact {
380382
switch artifact.Kind {
381383
case controlPlaneComponents:
@@ -413,7 +415,7 @@ func (s *Scanner) clusterInfoToReportResources(allArtifact []*artifacts.Artifact
413415
}
414416

415417
imageComponent := &core.Component{
416-
Type: core.TypeContainer,
418+
Type: core.TypeContainerImage,
417419
Name: name,
418420
Version: cDigest,
419421
PkgID: core.PkgID{

‎pkg/k8s/scanner/scanner_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ func TestScanner_Scan(t *testing.T) {
155155
},
156156
},
157157
{
158-
Type: core.TypeContainer,
158+
Type: core.TypeContainerImage,
159159
Name: "k8s.gcr.io/kube-apiserver",
160160
Version: "sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f",
161161
PkgID: core.PkgID{

‎pkg/report/spdx/spdx.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ func NewWriter(output io.Writer, version string, spdxFormat types.Format) Writer
3030
}
3131

3232
func (w Writer) Write(ctx context.Context, report types.Report) error {
33-
spdxDoc, err := w.marshaler.Marshal(ctx, report)
33+
spdxDoc, err := w.marshaler.MarshalReport(ctx, report)
3434
if err != nil {
3535
return xerrors.Errorf("failed to marshal spdx: %w", err)
3636
}

0 commit comments

Comments
 (0)