Skip to content

Commit fb36c4e

Browse files
DmitriyLewenknqyf263
DmitriyLewen
and
knqyf263
authored
refactor(sbom): use new metadata.tools struct for CycloneDX (aquasecurity#5981)
Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]>
1 parent f6be42b commit fb36c4e

File tree

22 files changed

+253
-166
lines changed

22 files changed

+253
-166
lines changed

‎docs/docs/supply-chain/sbom.md‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -217,13 +217,16 @@ $ cat result.json | jq .
217217
"version": 1,
218218
"metadata": {
219219
"timestamp": "2022-02-22T15:11:40.270597Z",
220-
"tools": [
221-
{
222-
"vendor": "aquasecurity",
223-
"name": "trivy",
224-
"version": "dev"
225-
}
226-
],
220+
"tools": {
221+
"components": [
222+
{
223+
"type": "application",
224+
"group": "aquasecurity",
225+
"name": "trivy",
226+
"version": "dev"
227+
}
228+
]
229+
},
227230
"component": {
228231
"bom-ref": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
229232
"type": "container",

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ require (
77
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.0
88
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0
99
github.com/BurntSushi/toml v1.3.2
10-
github.com/CycloneDX/cyclonedx-go v0.7.2
10+
github.com/CycloneDX/cyclonedx-go v0.8.0
1111
github.com/GoogleCloudPlatform/docker-credential-gcr v2.0.5+incompatible
1212
github.com/Masterminds/sprig/v3 v3.2.3
1313
github.com/NYTimes/gziphandler v1.1.1

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -237,8 +237,8 @@ github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbi
237237
github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
238238
github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
239239
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
240-
github.com/CycloneDX/cyclonedx-go v0.7.2 h1:kKQ0t1dPOlugSIYVOMiMtFqeXI2wp/f5DBIdfux8gnQ=
241-
github.com/CycloneDX/cyclonedx-go v0.7.2/go.mod h1:K2bA+324+Og0X84fA8HhN2X066K7Bxz4rpMQ4ZhjtSk=
240+
github.com/CycloneDX/cyclonedx-go v0.8.0 h1:FyWVj6x6hoJrui5uRQdYZcSievw3Z32Z88uYzG/0D6M=
241+
github.com/CycloneDX/cyclonedx-go v0.8.0/go.mod h1:K2bA+324+Og0X84fA8HhN2X066K7Bxz4rpMQ4ZhjtSk=
242242
github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
243243
github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
244244
github.com/DmitriyVTitov/size v1.5.0/go.mod h1:le6rNI4CoLQV1b9gzp1+3d7hMAD/uu2QcJ+aYbNgiU0=

‎integration/testdata/conda-cyclonedx.json.golden‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,16 @@
66
"version": 1,
77
"metadata": {
88
"timestamp": "2021-08-25T12:20:30+00:00",
9-
"tools": [
10-
{
11-
"vendor": "aquasecurity",
12-
"name": "trivy",
13-
"version": "dev"
14-
}
15-
],
9+
"tools": {
10+
"components": [
11+
{
12+
"type": "application",
13+
"group": "aquasecurity",
14+
"name": "trivy",
15+
"version": "dev"
16+
}
17+
]
18+
},
1619
"component": {
1720
"bom-ref": "3ff14136-e09f-4df9-80ea-000000000002",
1821
"type": "application",

‎integration/testdata/fluentd-multiple-lockfiles.cdx.json.golden‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,16 @@
66
"version": 1,
77
"metadata": {
88
"timestamp": "2021-08-25T12:20:30+00:00",
9-
"tools": [
10-
{
11-
"vendor": "aquasecurity",
12-
"name": "trivy",
13-
"version": "dev"
14-
}
15-
],
9+
"tools": {
10+
"components": [
11+
{
12+
"type": "application",
13+
"group": "aquasecurity",
14+
"name": "trivy",
15+
"version": "dev"
16+
}
17+
]
18+
},
1619
"component": {
1720
"bom-ref": "3ff14136-e09f-4df9-80ea-000000000002",
1821
"type": "container",

‎integration/testdata/pom-cyclonedx.json.golden‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,16 @@
66
"version": 1,
77
"metadata": {
88
"timestamp": "2021-08-25T12:20:30+00:00",
9-
"tools": [
10-
{
11-
"vendor": "aquasecurity",
12-
"name": "trivy",
13-
"version": "dev"
14-
}
15-
],
9+
"tools": {
10+
"components": [
11+
{
12+
"type": "application",
13+
"group": "aquasecurity",
14+
"name": "trivy",
15+
"version": "dev"
16+
}
17+
]
18+
},
1619
"component": {
1720
"bom-ref": "3ff14136-e09f-4df9-80ea-000000000002",
1821
"type": "application",

‎pkg/fanal/analyzer/sbom/testdata/cdx.json‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,16 @@
55
"version": 1,
66
"metadata": {
77
"timestamp": "2023-06-01T13:10:23+00:00",
8-
"tools": [
9-
{
10-
"vendor": "aquasecurity",
11-
"name": "trivy",
12-
"version": "0.41.0-80-g1c03982fe"
13-
}
14-
],
8+
"tools": {
9+
"components": [
10+
{
11+
"type": "application",
12+
"group": "aquasecurity",
13+
"name": "trivy",
14+
"version": "0.41.0-80-g1c03982fe"
15+
}
16+
]
17+
},
1518
"component": {
1619
"bom-ref": "pkg:oci/elasticsearch@sha256:d4b68b602eb3d92ea3256886761752ae1159dc01fd391f4c4a87ebf6ba9d3895?repository_url=index.docker.io%2Fbitnami%2Felasticsearch\u0026arch=arm64",
1720
"type": "container",

‎pkg/fanal/artifact/sbom/testdata/bom.json‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,16 @@
55
"version": 1,
66
"metadata": {
77
"timestamp": "2022-05-28T10:20:03.79527Z",
8-
"tools": [
9-
{
10-
"vendor": "aquasecurity",
11-
"name": "trivy",
12-
"version": "dev"
13-
}
14-
],
8+
"tools": {
9+
"components": [
10+
{
11+
"type": "application",
12+
"group": "aquasecurity",
13+
"name": "trivy",
14+
"version": "dev"
15+
}
16+
]
17+
},
1518
"component": {
1619
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
1720
"type": "container",

‎pkg/fanal/artifact/sbom/testdata/os-only-bom.json‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,16 @@
55
"version": 1,
66
"metadata": {
77
"timestamp": "2022-05-28T10:20:03.79527Z",
8-
"tools": [
9-
{
10-
"vendor": "aquasecurity",
11-
"name": "trivy",
12-
"version": "dev"
13-
}
14-
],
8+
"tools": {
9+
"components": [
10+
{
11+
"type": "application",
12+
"group": "aquasecurity",
13+
"name": "trivy",
14+
"version": "dev"
15+
}
16+
]
17+
},
1518
"component": {
1619
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
1720
"type": "container",

‎pkg/rekortest/server.go‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,14 @@ var (
5454
Version: 1,
5555
Metadata: &cyclonedx.Metadata{
5656
Timestamp: "2022-09-15T13:53:49+00:00",
57-
Tools: &[]cyclonedx.Tool{
58-
{
59-
Vendor: "aquasecurity",
60-
Name: "trivy",
61-
Version: "dev",
57+
Tools: &cyclonedx.ToolsChoice{
58+
Components: &[]cyclonedx.Component{
59+
{
60+
Type: cyclonedx.ComponentTypeApplication,
61+
Name: "trivy",
62+
Group: "aquasecurity",
63+
Version: "dev",
64+
},
6265
},
6366
},
6467
Component: &cyclonedx.Component{
@@ -175,11 +178,14 @@ var (
175178
Version: 1,
176179
Metadata: &cyclonedx.Metadata{
177180
Timestamp: "2022-10-21T09:50:08+00:00",
178-
Tools: &[]cyclonedx.Tool{
179-
{
180-
Vendor: "aquasecurity",
181-
Name: "trivy",
182-
Version: "dev",
181+
Tools: &cyclonedx.ToolsChoice{
182+
Components: &[]cyclonedx.Component{
183+
{
184+
Type: cyclonedx.ComponentTypeApplication,
185+
Name: "trivy",
186+
Group: "aquasecurity",
187+
Version: "dev",
188+
},
183189
},
184190
},
185191
Component: &cyclonedx.Component{

0 commit comments

Comments
 (0)