Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: kbom and cyclonedx v1.5 spec support #4708

Merged
merged 6 commits into from
Jun 25, 2023
Merged

feat: kbom and cyclonedx v1.5 spec support #4708

merged 6 commits into from
Jun 25, 2023

Conversation

chen-keinan
Copy link
Contributor

@chen-keinan chen-keinan commented Jun 25, 2023 •
edited
Loading

Description

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

Output Example :

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:049ea19f-edbc-478f-a39d-a84c2d7d63ff",
  "version": 1,
  "metadata": {
    "timestamp": "2023-06-25T05:46:22+00:00",
    "tools": [
      {
        "vendor": "aquasecurity",
        "name": "trivy",
        "version": "dev"
      }
    ],
    "component": {
      "bom-ref": "d2e2a084-a854-40df-84dc-1a7a6f523030",
      "type": "platform",
      "name": "kind-kind",
      "properties": []
    }
  },
  "components": [
    {
      "bom-ref": "000ff0c6-9aa5-4592-a3c2-a10eacfc037d",
      "type": "operating-system",
      "name": "ubuntu",
      "version": "21.04",
      "properties": [
        {
          "name": "aquasecurity:trivy:Class",
          "value": "os-pkgs"
        },
        {
          "name": "aquasecurity:trivy:Type",
          "value": "ubuntu"
        }
      ]
    },
    {
      "bom-ref": "35b3b3d5-0569-4b01-9785-717b569d5298",
      "type": "application",
      "name": "kube-apiserver-kind-control-plane",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kube-apiserver"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Type",
          "value": "ControlPlane"
        }
      ]
    },
    {
      "bom-ref": "5078a6ed-44e6-484b-b6ae-723aae5e0ca9",
      "type": "application",
      "name": "coredns-558bd4d5db-kkrn9",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kube-dns"
        }
      ]
    },
    {
      "bom-ref": "603d1d36-08be-436d-9627-c370a9256a2b",
      "type": "application",
      "name": "etcd-kind-control-plane",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "etcd"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Type",
          "value": "ControlPlane"
        }
      ]
    },
    {
      "bom-ref": "7c1b20c2-10ce-439e-ba98-667cfc78c546",
      "type": "platform",
      "name": "kind-control-plane",
      "properties": [
        {
          "name": "aquasecurity:trivy:Architecture",
          "value": "arm64"
        },
        {
          "name": "aquasecurity:trivy:HostName",
          "value": "kind-control-plane"
        },
        {
          "name": "aquasecurity:trivy:KernelVersion",
          "value": "6.3.6-200.fc38.aarch64"
        },
        {
          "name": "aquasecurity:trivy:NodeRole",
          "value": "master"
        },
        {
          "name": "aquasecurity:trivy:OperatingSystem",
          "value": "linux"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kind-control-plane"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Type",
          "value": "node"
        }
      ]
    },
    {
      "bom-ref": "9200f061-dbf6-42ba-8f44-aa50315499fc",
      "type": "application",
      "name": "kube-scheduler-kind-control-plane",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kube-scheduler"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Type",
          "value": "ControlPlane"
        }
      ]
    },
    {
      "bom-ref": "d6cbc351-d693-407e-b0de-3d2fd045e5f2",
      "type": "application",
      "name": "kindnet-vqpk7",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kindnet"
        }
      ]
    },
    {
      "bom-ref": "d7198858-924a-4337-a96d-7010ef7d556f",
      "type": "application",
      "name": "kube-proxy-8svpz",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kube-proxy"
        }
      ]
    },
    {
      "bom-ref": "dfbc591b-485c-4dfd-aedf-f9e82ee3e5cd",
      "type": "application",
      "name": "coredns-558bd4d5db-vdjwp",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kube-dns"
        }
      ]
    },
    {
      "bom-ref": "e66df66e-4ac9-4546-871b-9f94d0e4fa35",
      "type": "application",
      "name": "node-core-components",
      "properties": [
        {
          "name": "aquasecurity:trivy:Class",
          "value": "lang-pkgs"
        },
        {
          "name": "aquasecurity:trivy:Type",
          "value": "golang"
        }
      ]
    },
    {
      "bom-ref": "f5533807-0a2f-44e3-969c-96f0738173f3",
      "type": "application",
      "name": "kube-controller-manager-kind-control-plane",
      "properties": [
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "kube-controller-manager"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Type",
          "value": "ControlPlane"
        }
      ]
    },
    {
      "bom-ref": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@1.5.2",
      "type": "library",
      "name": "github.com/containerd/containerd",
      "version": "1.5.2",
      "purl": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@1.5.2",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "golang"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "github.com/containerd/containerd"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Type",
          "value": "node"
        }
      ]
    },
    {
      "bom-ref": "pkg:golang/k8s.io%2Fkubelet@1.21.1",
      "type": "library",
      "name": "k8s.io/kubelet",
      "version": "1.21.1",
      "purl": "pkg:golang/k8s.io%2Fkubelet@1.21.1",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "golang"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Name",
          "value": "k8s.io/kubelet"
        },
        {
          "name": "aquasecurity:trivy:k8s:component:Type",
          "value": "node"
        }
      ]
    },
    {
      "bom-ref": "pkg:oci/coredns@sha256:1a1f05a2cd7c2fbfa7b45b21128c8a4880c003ca482460081dc12d76bfa863e8?repository_url=k8s.gcr.io%2Fcoredns%2Fcoredns\u0026arch=",
      "type": "container",
      "name": "k8s.gcr.io/coredns/coredns",
      "version": "sha256:1a1f05a2cd7c2fbfa7b45b21128c8a4880c003ca482460081dc12d76bfa863e8",
      "purl": "pkg:oci/coredns@sha256:1a1f05a2cd7c2fbfa7b45b21128c8a4880c003ca482460081dc12d76bfa863e8?repository_url=k8s.gcr.io%2Fcoredns%2Fcoredns\u0026arch=",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgID",
          "value": "k8s.gcr.io/coredns/coredns:1.8.0"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "oci"
        }
      ]
    },
    {
      "bom-ref": "pkg:oci/etcd@sha256:05b738aa1bc6355db8a2ee8639f3631b908286e43f584a3d2ee0c472de033c28?repository_url=k8s.gcr.io%2Fetcd\u0026arch=",
      "type": "container",
      "name": "k8s.gcr.io/etcd",
      "version": "sha256:05b738aa1bc6355db8a2ee8639f3631b908286e43f584a3d2ee0c472de033c28",
      "purl": "pkg:oci/etcd@sha256:05b738aa1bc6355db8a2ee8639f3631b908286e43f584a3d2ee0c472de033c28?repository_url=k8s.gcr.io%2Fetcd\u0026arch=",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgID",
          "value": "k8s.gcr.io/etcd:3.4.13-0"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "oci"
        }
      ]
    },
    {
      "bom-ref": "pkg:oci/kindnetd@sha256:f37b7c809e5dcc2090371f933f7acb726bb1bffd5652980d2e1d7e2eff5cd301?repository_url=index.docker.io%2Fkindest%2Fkindnetd\u0026arch=",
      "type": "container",
      "name": "index.docker.io/kindest/kindnetd",
      "version": "sha256:f37b7c809e5dcc2090371f933f7acb726bb1bffd5652980d2e1d7e2eff5cd301",
      "purl": "pkg:oci/kindnetd@sha256:f37b7c809e5dcc2090371f933f7acb726bb1bffd5652980d2e1d7e2eff5cd301?repository_url=index.docker.io%2Fkindest%2Fkindnetd\u0026arch=",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgID",
          "value": "index.docker.io/kindest/kindnetd:20210326-1e038dc5"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "oci"
        }
      ]
    },
    {
      "bom-ref": "pkg:oci/kube-apiserver@sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f?repository_url=k8s.gcr.io%2Fkube-apiserver\u0026arch=",
      "type": "container",
      "name": "k8s.gcr.io/kube-apiserver",
      "version": "sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f",
      "purl": "pkg:oci/kube-apiserver@sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f?repository_url=k8s.gcr.io%2Fkube-apiserver\u0026arch=",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgID",
          "value": "k8s.gcr.io/kube-apiserver:1.21.1"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "oci"
        }
      ]
    },
    {
      "bom-ref": "pkg:oci/kube-controller-manager@sha256:0c6dccae49de8003ee4fa06db04a9f13bb46cbaad03977e6baa21174f2dba2fc?repository_url=k8s.gcr.io%2Fkube-controller-manager\u0026arch=",
      "type": "container",
      "name": "k8s.gcr.io/kube-controller-manager",
      "version": "sha256:0c6dccae49de8003ee4fa06db04a9f13bb46cbaad03977e6baa21174f2dba2fc",
      "purl": "pkg:oci/kube-controller-manager@sha256:0c6dccae49de8003ee4fa06db04a9f13bb46cbaad03977e6baa21174f2dba2fc?repository_url=k8s.gcr.io%2Fkube-controller-manager\u0026arch=",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgID",
          "value": "k8s.gcr.io/kube-controller-manager:1.21.1"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "oci"
        }
      ]
    },
    {
      "bom-ref": "pkg:oci/kube-proxy@sha256:4bbef4ca108cdc3b99fe23d487fa4fca933a62c4fc720626a3706df9cef63b21?repository_url=k8s.gcr.io%2Fkube-proxy\u0026arch=",
      "type": "container",
      "name": "k8s.gcr.io/kube-proxy",
      "version": "sha256:4bbef4ca108cdc3b99fe23d487fa4fca933a62c4fc720626a3706df9cef63b21",
      "purl": "pkg:oci/kube-proxy@sha256:4bbef4ca108cdc3b99fe23d487fa4fca933a62c4fc720626a3706df9cef63b21?repository_url=k8s.gcr.io%2Fkube-proxy\u0026arch=",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgID",
          "value": "k8s.gcr.io/kube-proxy:1.21.1"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "oci"
        }
      ]
    },
    {
      "bom-ref": "pkg:oci/kube-scheduler@sha256:8c783dd2520887cc8e7908489ffc9f356c82436ba0411d554237a0b9632c9b87?repository_url=k8s.gcr.io%2Fkube-scheduler\u0026arch=",
      "type": "container",
      "name": "k8s.gcr.io/kube-scheduler",
      "version": "sha256:8c783dd2520887cc8e7908489ffc9f356c82436ba0411d554237a0b9632c9b87",
      "purl": "pkg:oci/kube-scheduler@sha256:8c783dd2520887cc8e7908489ffc9f356c82436ba0411d554237a0b9632c9b87?repository_url=k8s.gcr.io%2Fkube-scheduler\u0026arch=",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgID",
          "value": "k8s.gcr.io/kube-scheduler:1.21.1"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "oci"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "000ff0c6-9aa5-4592-a3c2-a10eacfc037d",
      "dependsOn": []
    },
    {
      "ref": "35b3b3d5-0569-4b01-9785-717b569d5298",
      "dependsOn": [
        "pkg:oci/kube-apiserver@sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f?repository_url=k8s.gcr.io%2Fkube-apiserver\u0026arch="
      ]
    },
    {
      "ref": "5078a6ed-44e6-484b-b6ae-723aae5e0ca9",
      "dependsOn": [
        "pkg:oci/coredns@sha256:1a1f05a2cd7c2fbfa7b45b21128c8a4880c003ca482460081dc12d76bfa863e8?repository_url=k8s.gcr.io%2Fcoredns%2Fcoredns\u0026arch="
      ]
    },
    {
      "ref": "603d1d36-08be-436d-9627-c370a9256a2b",
      "dependsOn": [
        "pkg:oci/etcd@sha256:05b738aa1bc6355db8a2ee8639f3631b908286e43f584a3d2ee0c472de033c28?repository_url=k8s.gcr.io%2Fetcd\u0026arch="
      ]
    },
    {
      "ref": "7c1b20c2-10ce-439e-ba98-667cfc78c546",
      "dependsOn": [
        "000ff0c6-9aa5-4592-a3c2-a10eacfc037d",
        "e66df66e-4ac9-4546-871b-9f94d0e4fa35"
      ]
    },
    {
      "ref": "9200f061-dbf6-42ba-8f44-aa50315499fc",
      "dependsOn": [
        "pkg:oci/kube-scheduler@sha256:8c783dd2520887cc8e7908489ffc9f356c82436ba0411d554237a0b9632c9b87?repository_url=k8s.gcr.io%2Fkube-scheduler\u0026arch="
      ]
    },
    {
      "ref": "d2e2a084-a854-40df-84dc-1a7a6f523030",
      "dependsOn": [
        "35b3b3d5-0569-4b01-9785-717b569d5298",
        "5078a6ed-44e6-484b-b6ae-723aae5e0ca9",
        "603d1d36-08be-436d-9627-c370a9256a2b",
        "7c1b20c2-10ce-439e-ba98-667cfc78c546",
        "9200f061-dbf6-42ba-8f44-aa50315499fc",
        "d6cbc351-d693-407e-b0de-3d2fd045e5f2",
        "d7198858-924a-4337-a96d-7010ef7d556f",
        "dfbc591b-485c-4dfd-aedf-f9e82ee3e5cd",
        "f5533807-0a2f-44e3-969c-96f0738173f3"
      ]
    },
    {
      "ref": "d6cbc351-d693-407e-b0de-3d2fd045e5f2",
      "dependsOn": [
        "pkg:oci/kindnetd@sha256:f37b7c809e5dcc2090371f933f7acb726bb1bffd5652980d2e1d7e2eff5cd301?repository_url=index.docker.io%2Fkindest%2Fkindnetd\u0026arch="
      ]
    },
    {
      "ref": "d7198858-924a-4337-a96d-7010ef7d556f",
      "dependsOn": [
        "pkg:oci/kube-proxy@sha256:4bbef4ca108cdc3b99fe23d487fa4fca933a62c4fc720626a3706df9cef63b21?repository_url=k8s.gcr.io%2Fkube-proxy\u0026arch="
      ]
    },
    {
      "ref": "dfbc591b-485c-4dfd-aedf-f9e82ee3e5cd",
      "dependsOn": [
        "pkg:oci/coredns@sha256:1a1f05a2cd7c2fbfa7b45b21128c8a4880c003ca482460081dc12d76bfa863e8?repository_url=k8s.gcr.io%2Fcoredns%2Fcoredns\u0026arch="
      ]
    },
    {
      "ref": "e66df66e-4ac9-4546-871b-9f94d0e4fa35",
      "dependsOn": [
        "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@1.5.2",
        "pkg:golang/k8s.io%2Fkubelet@1.21.1"
      ]
    },
    {
      "ref": "f5533807-0a2f-44e3-969c-96f0738173f3",
      "dependsOn": [
        "pkg:oci/kube-controller-manager@sha256:0c6dccae49de8003ee4fa06db04a9f13bb46cbaad03977e6baa21174f2dba2fc?repository_url=k8s.gcr.io%2Fkube-controller-manager\u0026arch="
      ]
    },
    {
      "ref": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@1.5.2",
      "dependsOn": []
    },
    {
      "ref": "pkg:golang/k8s.io%2Fkubelet@1.21.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:oci/coredns@sha256:1a1f05a2cd7c2fbfa7b45b21128c8a4880c003ca482460081dc12d76bfa863e8?repository_url=k8s.gcr.io%2Fcoredns%2Fcoredns\u0026arch=",
      "dependsOn": []
    },
    {
      "ref": "pkg:oci/etcd@sha256:05b738aa1bc6355db8a2ee8639f3631b908286e43f584a3d2ee0c472de033c28?repository_url=k8s.gcr.io%2Fetcd\u0026arch=",
      "dependsOn": []
    },
    {
      "ref": "pkg:oci/kindnetd@sha256:f37b7c809e5dcc2090371f933f7acb726bb1bffd5652980d2e1d7e2eff5cd301?repository_url=index.docker.io%2Fkindest%2Fkindnetd\u0026arch=",
      "dependsOn": []
    },
    {
      "ref": "pkg:oci/kube-apiserver@sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f?repository_url=k8s.gcr.io%2Fkube-apiserver\u0026arch=",
      "dependsOn": []
    },
    {
      "ref": "pkg:oci/kube-controller-manager@sha256:0c6dccae49de8003ee4fa06db04a9f13bb46cbaad03977e6baa21174f2dba2fc?repository_url=k8s.gcr.io%2Fkube-controller-manager\u0026arch=",
      "dependsOn": []
    },
    {
      "ref": "pkg:oci/kube-proxy@sha256:4bbef4ca108cdc3b99fe23d487fa4fca933a62c4fc720626a3706df9cef63b21?repository_url=k8s.gcr.io%2Fkube-proxy\u0026arch=",
      "dependsOn": []
    },
    {
      "ref": "pkg:oci/kube-scheduler@sha256:8c783dd2520887cc8e7908489ffc9f356c82436ba0411d554237a0b9632c9b87?repository_url=k8s.gcr.io%2Fkube-scheduler\u0026arch=",
      "dependsOn": []
    }
  ],
  "vulnerabilities": []
}

@chen-keinan
feat: kbom and cyclonedx v1.5 spec support
1e87e6d 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan
feat: kbom and cyclonedx v1.5 spec support
d31088a 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan
feat: kbom and cyclonedx v1.5 spec support
2721fa3 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan
feat: feat: kbom and cyclonedx 1.5 spec support
f619b88 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan chen-keinan force-pushed the feat/cyclonedx-1.5-spec-support branch from 68ed51f to f619b88 Compare June 25, 2023 09:51
@chen-keinan
fix: unmarshal bom on v1.5 return invalid specification version
dea505c 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan
feat: cyclonedx-1.5 spec support
c4ea350 
Signed-off-by: chenk <hen.keinan@gmail.com>
@chen-keinan
Copy link
Contributor Author

chen-keinan commented Jun 25, 2023 •
edited
Loading

@knqyf263 go-cyclonedx with version 1.5 support add new json schema field to output:

"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json"

@chen-keinan chen-keinan marked this pull request as ready for review June 25, 2023 13:09
@knqyf263 knqyf263 added this pull request to the merge queue Jun 25, 2023
Merged via the queue into aquasecurity:main with commit 85c681d Jun 25, 2023
18 checks passed
AnaisUrlichs pushed a commit to AnaisUrlichs/trivy that referenced this pull request Aug 10, 2023
@chen-keinan @AnaisUrlichs
feat: kbom and cyclonedx v1.5 spec support (aquasecurity#4708)
48cc62a 
* feat: kbom and cyclonedx v1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kbom and cyclonedx v1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kbom and cyclonedx v1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: feat: kbom and cyclonedx 1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* fix: unmarshal bom on v1.5 return invalid specification version

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: cyclonedx-1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

---------

Signed-off-by: chenk <hen.keinan@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@knqyf263 knqyf263 knqyf263 approved these changes

@josedonizetti josedonizetti Awaiting requested review from josedonizetti

@AnaisUrlichs AnaisUrlichs Awaiting requested review from AnaisUrlichs

@itaysk itaysk Awaiting requested review from itaysk

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

bump go-cyclonedx to version 1.5
2 participants
@chen-keinan @knqyf263