CRAVEX-integration: Integration with SCA Tools: cyclonedx-gomod

[pombredanne]

Integrate and import Vuls scans

Integrate and import https://github.com/CycloneDX/cyclonedx-gomod scans

[pombredanne]

@tdruez I reckon that this vuls tool is problematic and may be too hard to get to work and produce something usable

I suggest instead that you pick any of these tools, in no specific order:

• https://github.com/intel/cve-bin-tool
• https://github.com/advanced-security/gh-sbom and https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exporting-a-software-bill-of-materials-for-your-repository
• https://github.com/CycloneDX/cyclonedx-gomod
• https://github.com/eclipse-jbom/jbom
• https://github.com/rad-security/kbom
• https://github.com/kubernetes-sigs/bom
• https://github.com/voltone/sbom
• may be interesting as it can convert? formats may be with https://github.com/protobom/sbom-convert and https://github.com/protobom/protobom
• https://github.com/anthonyharrison/distro2sbom
• https://github.com/anthonyharrison/sbom4python
• https://github.com/anthonyharrison/sbom4rust

[pombredanne]

@tdruez I think https://github.com/CycloneDX/cyclonedx-gomod is one to pick alright as a replacement for VULS. I had issues to get cve-bin-tool to produce an SBOM.

[tdruez]

• Implemented at [CRAVEX] SCA Integrations: cyclonedx-gomod #1905

Changes:

• Add a unit test to ensure the cyclonedx-gomod. SBOM support
• Add a GitHub workflow that runs every week to ensure the cyclonedx-gomod SBOM support (see below for details)

Workflow

Available at .github/workflows/sca-integration-cyclonedx-gomod.yml

Documentation:

# This workflow:
#  1. Generates a CycloneDX SBOM for a container image using cyclonedx-gomod.
#  2. Uploads the SBOM as a GitHub artifact for future inspection.
#  3. Loads the SBOM into ScanCode.io for further analysis.
#  4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
#
# It runs on demand, and once a week (scheduled).