SPDX Parser: ingest CPE from externalRefs

[mrizzi]

Description of the PR

2023-10-09 update

After the discussion on how to best manage the CPE information, the new HasMetadata based approach has been pushed.

Initial proposal

The changes in this PR are meant to read the referenceLocator values for the externalRefs with referenceCategory: SECURITY and referenceType equals cpe22Type or cpe23Type.

In order to properly sustain the correlation's requirement, CPE found is translated into a purl using an approach similar to the GuacPkgPurl func generated purl.

The CPE-based purl will be created following this algorithm:

• cpe as the hardcoded purl type
• cpe vendor as purl namespace
• cpe product as purl name
• cpe version as purl version
• cpe part as purl qualifier cpe-part
• cpe update as purl qualifier cpe-update
• cpe edition as purl qualifier cpe-edition
• cpe lang as purl qualifier cpe-lang
• cpe sw_edition as purl qualifier cpe-sw-edition
• cpe target_sw as purl qualifier cpe-target-sw
• cpe target_hw as purl qualifier cpe-target-hw
• cpe other as purl qualifier cpe-other

So, for example, the CPE

cpe:/o:redhat:enterprise_linux:7::server

will generate the purl

pkg:cpe/redhat/enterprise_linux@7?cpe-part=o&cpe-update=ANY&cpe-edition=server&cpe-lang=ANY&cpe-other=ANY&cpe-sw-edition=ANY&cpe-target-hw=ANY&cpe-target-sw=ANY

The SPDX parser also generates PkgEqual predicate between the current purl package and the CPE-based purl in order to have into guac also this information.

A follow-up PR must be opened to change consistently https://github.com/guacsec/guac-docs/blob/main/guac-graphql.md

Fixes #1346

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged

[pxp928]

Thanks @mrizzi this makes sense. Questions about if we need the redundant verbs for the CPEs

[mrizzi]

@pxp928 @lumjjb @mihaimaruseac the HasMetadata approach has been implemented

[pxp928]

Awesome! Thanks

[mihaimaruseac]

LGTM, but deferring to @lumjjb for second approval

[lumjjb]

LGTM!