Create a purl to cpe enrichment provider

[qtpeters]

Target Audience

SBOM Harbor users

What’s the Value

Using the purl(s) included in each SBOM to derive the associated cpe(s) will allow SBOM Harbor to extract vulnerability information directly from NVD and allow the Harbor Team to develop an NVD vulnerability enrichment source.

Details

A CPE ID will only exist for dependencies that have a corresponding CPE ID in the NVD.

Definition of Done

This ticket is finished when:

• A task exists to update the existing SBOM metadata in DocumentDB with the CPE ID(s) associated to the existing purl(s)
• That task is running on schedule.
• CPEs are queryable from the SDL, when they exist.