mirror of
https://github.com/aphrody-labs/msys2-devtools.git
synced 2026-10-14 04:19:12 +00:00
Christoph Reiter
da03cb0a01
In case of components with purl the name has to match the name of the project as encoded in the prul (for whatever reason) or otherwise grype will not find any CVEs for them. Currently we are using the name match pkgbase, so we can connect vulns to packages in msys2-web. With this no longer working add a "msys2:pkgbase" property to the SBOM. But since grype throws out everything non-essential from the input SBOM add a command that merges the property from the source to the enriched SBOM. And since we can't even have an ID to connect components there match by comparing various fields (name, version, cpe, purl). This means the new process is like this: * Generate SBOM with "sbom create" * Run grype to generate cdx SBOM with VEX * Add properties to grype SBOM via "sbom merge" * In msys2-web instead of taking "name" look for a property called "msys2:pkgbase" While at it also use the CPE project name for the SBOM component name, and remove the version from the CPE, since grype doesn't seem to use it, and we avoid having to escape things in the CPE. And also try to normalize versions a bit.