Tool to convert SCARF files to SARIF files
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE.txt
README.adoc
swamp-scarf-sarif

README.adoc

SWAMP SCARF to SARIF

Module Version: 0.8.3

Last updated on 11-20-2018

Sarif version currently tracking: 2.0.0-csd.2.beta.2018-10-10

Description

The Software Assurance Marketplace (SWAMP) runs software assurance tools, and converts the results of each tool into a common format called SCARF (SWAMP Common Assessment Result Format). There exists a new format being developed by OASIS called SARIF. This repository contains a command line program that takes in a SCARF file as well as other data generated by an assessment in SWAMP and outputs a SARIF file. This converter uses swamp-sarif-io to create the output file. See its documentation for the SARIF features supported.

Usage

Usage: ./swamp-scarf-sarif [options]

options:
    --help                      -h print this message
    --version                   -v print version
    --compact                   -c print compactly (no indents)
    --scarf=<FILE>              -x path to scarf file
    --summary=<FILE>            -s path to assessment_summary file
    --hashes=<FILE>             -l path to file containing list of hashes
    --build=<DIR>               -b path to build directory
    --error=<STRING>            -e reasons assessment failed
    --output=<FILE>             -o output file name/path
    --setenv                    -n reduce conversion env output

Examples

This command generates the most complete sarif file possible by providing all the data used by the converter that is available in a SWAMP output directory:

swamp-scarf-sarif --scarf $dirName/parsed_results/parsed_results.xml --summary $dirName/results/assessment_summary.xml --hashes $dirName/hashes.txt --build $dirName/build/ --output output.sarif

This command generates a sarif file containing an error message indicating that the assessment failed:

swamp-scarf-sarif --error "Assessment failed due to incompatible platform" --output output.sarif

Requirements

The following Perl libraries should be installed for the program to work correctly: