ignore_vulnerabilities gets mapped into the "analysis" property
of the vul referenced by the package defining ignore_vulnerabilities.
We default to "not_affected" for now, since we only store the ID in
our PKGBUILD and no reason/justification etc.
newer grype no longer merges components, and also preserves
syft:location:0:path accross formats, so we no longer need the input
json to associate vulns with packages.
Keep the old command for now to make the transition easier.
The grype json output contains information about whether there is
a fixed version available, but doesn't include this info in the cdx
format we use.
There isn't really a direct match in cdx, but we can include the "fixed"
versions, under the "versions" field of the affected target and mark them
as "unaffected".
In the frontend we can then show the unaffected versions that are newer
than the current one as "fixed" versions.
grype has started to duplicate all components in the output sbom,
which led to us assining the pkgbase link to multiple components
which ened up with duplicate CVEs in the frontend.
Avoid by only merging in the old properties once.
Alternative would be to dedupe by vuln ID in the frontend, but let's
keep it simple.
Example to get all packages built with that crt version that contain a *.a file:
msys2-repo-buildinfo /repo \
--built-with-package="mingw-w64-ucrt-x86_64-crt-git=12.0.0.r619.g850703ae4-1" \
--contains-file="*.a"
Starting with 0.91.1 grype will match a CVE if the component name matches
the ecosystem package, even if the CPE is unrelated.
Work around by setting "syft:package:type" for those components, which
for some reason makes it stop doing that.
* Instead of treating None as ANY, introduce proper values for both
* Trailing ":" in 2.3 are treatet as empty values now
* Disallow empty components, as they are not representable with 2.2,
to avoid surprises when converting between them
* Handle NA in both 2.2 and 2.3
* Handle literal "-" in both 2.2 and 2.3 by force escaping
* properly implement unescaping for v2.3 CPEs
* extend the CPE we write to the sbom with the version
* always write v2.2 CPEs to the sbom since those are easier to build
* in case a CPE contains a version, use that over pkgver
Fixes#12
it was extended to allow duplicate keys at some point
to support PURL, and just forked. Update the other users
to deal with this again and merge teh code.
In case a PURL reference has a version included we use that instead
of the pkgver.
This is helpful in case the version format is different on pypi for
example, or when referencing github and the version tag is prefixed with "v".
We have multiple packages with the same CPE, and since we now have
multiple components with the same name they get merged by grype into
one, which means each SBOM component can point to multiple pkgbase
values.
In case of components with purl the name has to match the name of
the project as encoded in the prul (for whatever reason) or otherwise
grype will not find any CVEs for them.
Currently we are using the name match pkgbase, so we can connect
vulns to packages in msys2-web.
With this no longer working add a "msys2:pkgbase" property to the SBOM.
But since grype throws out everything non-essential from the input SBOM
add a command that merges the property from the source to the enriched
SBOM. And since we can't even have an ID to connect components there
match by comparing various fields (name, version, cpe, purl).
This means the new process is like this:
* Generate SBOM with "sbom create"
* Run grype to generate cdx SBOM with VEX
* Add properties to grype SBOM via "sbom merge"
* In msys2-web instead of taking "name" look for a property called "msys2:pkgbase"
While at it also use the CPE project name for the SBOM component name, and
remove the version from the CPE, since grype doesn't seem to use it, and
we avoid having to escape things in the CPE.
And also try to normalize versions a bit.
Bash variables starting with msys2_ or mingw_ in the PKGBUILD will
now be included in the srcinfo cache under "extra". This supports
both strings and arrays of strings.
Christoph Reiter