Add initial support for embedded CycloneDX VEX documents #678

samj1912 · 2022-03-17T19:47:40Z

Signed-off-by: Sambhav Kothari skothari44@bloomberg.net

Fixes #591

This adds some initial support for CycloneDX VEX documents. There are a couple of things we will need to think through -

Currently this PR produces an embedded VEX document - i.e. we duplicate partial information from the components in the VEX document, add a bom-ref for each and then have the vulnerabilities link to the bom-refs in the same BOM. (We should also verify if my usage of links for components within the same bom is accurate or not, I could not find any example of embedded VEX files at https://github.com/CycloneDX/bom-examples/tree/master/VEX but it is supported according to the docs)
We need to figure out a way to inject bom-refs in syft for components. Currently I use the PURL when available as a bom-ref and if it is not I use $type-$name-$version as the bom ref.
We need to figure out a way to pass bom-refs from input sboms to grype so that it can reference it in the vex. In case an input is provided that does not contain a cyclonedx sbom and a non embedded vex is selected, we would need to output both a cyclonedx SBOM and a VEX from grype (this is one possible solution but we can explore other alternatives)
Currently grype converts input formats into its internal schema which leads to some loss in information that is format specific (for eg. bom refs in cyclonedx's case) - we need to figure out some way to preserve such info if a bom is given as an input.
VEX had a number of breaking changes from the previous vulnerability extension schema in cyclonedx. As a result, I have kept the previous extension output for b/w compat. See Added vulnerabilities as part of core spec CycloneDX/specification#91 for a full list of changes.
Because of the lack of support for bom refs in spdx, we would need to figure out a way to generate a non-embedded vex for spdx sbom inputs or we may choose to error out entirely if the input is an spdx bom and the output is a non-embedded cyclonedx vex document until we figure out a way to have bom-refs for spdx documents.

Marking it as a draft while we resolve the above questions.

cc: @luhring , @wagoodman , @spiffcs , @kzantow , @stevespringett, @coderpatros, @nscuro

schema/cyclonedxvex/README.md

grype/presenter/format.go

grype/presenter/cyclonedxvex/document.go

samj1912 · 2022-03-31T22:02:34Z

The first cut of this VEX PR is done.

I have opted to go with an embedded VEX for now so that it is portable across input SBOMs, we can add support for external VEX once the upstream syft PR lands and we have more discussions on how we want to pass format specific data around in grype. (in this case the cdx bom's uuid)

I have also opted to generate a minimal list of components for the embedded VEX which use the same bom ref generation process as the sibling syft PR anchore/syft#914

Finally from conversations with the cyclonedx core team, I have verified that in case of embedded vex documents, the target ref needs to be a bom ref and not an external link. I have put up a PR at CycloneDX/specification#136 to document the same in the upstream spec.

Finally I have added an initial vuln. analysis state of "in_triage" which we can expand upon in the future with something like grype --interactive

wagoodman · 2022-04-01T18:56:43Z

grype/presenter/cyclonedxvex/document.go

+	// TODO: In the future we may want to dedupe by PURL and combine components with
+	// the same PURL while preserving their unique metadata.
+	if parsedPURL, err := packageurl.FromString(p.PURL); err == nil {
+		parsedPURL.Qualifiers = append(parsedPURL.Qualifiers, packageurl.Qualifier{Key: "syft-id", Value: string(p.ID)})


there is no longer a guarantee that the input SBOM will be from syft, so having a syft-id key here could be misleading in some cases. (also, if we make a change here, we should probably head back to syft and match these approaches up... maybe simply id would suffice?)

wagoodman · 2022-04-01T18:59:41Z

grype/presenter/format.go

+	embeddedVEXJSON format = "embedded-cyclonedx-vex-json"
+	embeddedVEXXML  format = "embedded-cyclonedx-vex-xml"


these are accurate, though pretty verbose. I'll give a little more thought to something that is shorter / friendlier to input.

I don't have any suggestions for how these could be shorter. @wagoodman did you still have thoughts?

hectorj2f · 2022-04-19T11:54:06Z

👋🏻 @samj1912, Do you need a hand with the changes ? We'd be glad to help :)

samj1912 · 2022-04-19T11:59:24Z

👋🏻 @samj1912, Do you need a hand with the changes ? We'd be glad to help :)

I think the PR is functionally complete. Waiting for @wagoodman's reply on better output format names. As for the syft-id, id comment, will address that soon but I think we should use something more specific than id. Maybe package-id? Thoughts?

hectorj2f · 2022-04-19T15:23:56Z

@samj1912 that is great, I'll give it a try. It sounds good to me to use package ids.

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>

samj1912 · 2022-04-27T17:54:05Z

Updated this PR to reflect the comments around syft-id v/s package-id.

spiffcs

Approved! Thanks for the contribution @samj1912. I tagged @wagoodman on his comment regarding verbosity of options, but after giving this a run locally and looking at the code I don't see any issues.

spiffcs · 2022-04-28T13:20:42Z

grype/presenter/format.go

+	embeddedVEXJSON format = "embedded-cyclonedx-vex-json"
+	embeddedVEXXML  format = "embedded-cyclonedx-vex-xml"


I don't have any suggestions for how these could be shorter. @wagoodman did you still have thoughts?

hectorj2f · 2022-04-28T17:05:35Z

@samj1912 Thanks 👏🏻

samj1912 force-pushed the vex branch 2 times, most recently from 5345ea9 to e65fa54 Compare March 17, 2022 20:02

samj1912 mentioned this pull request Mar 17, 2022

[bug] BOMEncoder for vulnerabilities adds a default score of 0 if not specified CycloneDX/cyclonedx-go#25

Closed

hectorj2f reviewed Mar 17, 2022

View reviewed changes

schema/cyclonedxvex/README.md Outdated Show resolved Hide resolved

hectorj2f reviewed Mar 17, 2022

View reviewed changes

grype/presenter/format.go Outdated Show resolved Hide resolved

hectorj2f reviewed Mar 17, 2022

View reviewed changes

grype/presenter/format.go Outdated Show resolved Hide resolved

hectorj2f reviewed Mar 17, 2022

View reviewed changes

grype/presenter/cyclonedxvex/document.go Show resolved Hide resolved

samj1912 force-pushed the vex branch 2 times, most recently from 2d37bb0 to 49bef16 Compare March 31, 2022 21:51

samj1912 marked this pull request as ready for review March 31, 2022 21:52

samj1912 force-pushed the vex branch from 49bef16 to 0c93bd6 Compare March 31, 2022 22:00

samj1912 force-pushed the vex branch 2 times, most recently from 04d32aa to 95a9d49 Compare March 31, 2022 22:05

wagoodman reviewed Apr 1, 2022

View reviewed changes

samj1912 requested a review from wagoodman April 19, 2022 11:59

spiffcs self-assigned this Apr 27, 2022

samj1912 mentioned this pull request Apr 27, 2022

Rename syft-id to package-id anchore/syft#970

Merged

Add initial support for embedded CycloneDX VEX documents

ed73d22

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>

samj1912 force-pushed the vex branch from 95a9d49 to ed73d22 Compare April 27, 2022 17:53

spiffcs approved these changes Apr 28, 2022

View reviewed changes

spiffcs self-requested a review April 28, 2022 16:23

spiffcs changed the title ~~Add initial support for embedded CycloneDX VEX documents~~ add initial support for embedded CycloneDX VEX documents Apr 28, 2022

spiffcs merged commit 9f70cdb into anchore:main Apr 28, 2022

samj1912 deleted the vex branch April 28, 2022 17:34

samj1912 changed the title ~~add initial support for embedded CycloneDX VEX documents~~ Qdd initial support for embedded CycloneDX VEX documents Apr 29, 2022

samj1912 changed the title ~~Qdd initial support for embedded CycloneDX VEX documents~~ Add initial support for embedded CycloneDX VEX documents Apr 29, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add initial support for embedded CycloneDX VEX documents #678

Add initial support for embedded CycloneDX VEX documents #678

samj1912 commented Mar 17, 2022 •

edited

samj1912 commented Mar 31, 2022 •

edited

wagoodman Apr 1, 2022

wagoodman Apr 1, 2022

spiffcs Apr 28, 2022

hectorj2f commented Apr 19, 2022

samj1912 commented Apr 19, 2022

hectorj2f commented Apr 19, 2022

samj1912 commented Apr 27, 2022

spiffcs left a comment

spiffcs Apr 28, 2022

hectorj2f commented Apr 28, 2022

		embeddedVEXJSON format = "embedded-cyclonedx-vex-json"
		embeddedVEXXML format = "embedded-cyclonedx-vex-xml"

Add initial support for embedded CycloneDX VEX documents #678

Add initial support for embedded CycloneDX VEX documents #678

Conversation

samj1912 commented Mar 17, 2022 • edited

samj1912 commented Mar 31, 2022 • edited

wagoodman Apr 1, 2022

Choose a reason for hiding this comment

wagoodman Apr 1, 2022

Choose a reason for hiding this comment

spiffcs Apr 28, 2022

Choose a reason for hiding this comment

hectorj2f commented Apr 19, 2022

samj1912 commented Apr 19, 2022

hectorj2f commented Apr 19, 2022

samj1912 commented Apr 27, 2022

spiffcs left a comment

Choose a reason for hiding this comment

spiffcs Apr 28, 2022

Choose a reason for hiding this comment

hectorj2f commented Apr 28, 2022

samj1912 commented Mar 17, 2022 •

edited

samj1912 commented Mar 31, 2022 •

edited