✨ Adding CycloneDX 1.4 and 1.5 reporter#1014
Conversation
oliverchang
left a comment
There was a problem hiding this comment.
thank you very much for contributing this! we'd love to support this feature in OSV-Scanner. I just have some comments.
…ered due to PURL malformation
… the grouper in the reporter instead 🚧 To be merged with be81d969
another-rex
left a comment
There was a problem hiding this comment.
Thanks! I haven't had time to look into this recently, but I'll take a deeper look this week.
… it to Group to match conventions
another-rex
left a comment
There was a problem hiding this comment.
Some minor comments, otherwise LGTM!
…CycloneDX_reporter
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1014 +/- ##
=======================================
Coverage ? 65.74%
=======================================
Files ? 159
Lines ? 12776
Branches ? 0
=======================================
Hits ? 8400
Misses ? 3905
Partials ? 471 ☔ View full report in Codecov by Sentry. |
another-rex
left a comment
There was a problem hiding this comment.
Thanks! Will aim to get this merged in next week.
About this PR
This PR aims to add the CycloneDX 1.4 and 1.5 format. The idea behind it is to be able to export everything in a commonly used format to later reuse the result to enrich it. (ex: re-running a vulnerability matching process on the packages to find emerging vulnerabilities).
This PR adds 2 versions of CycloneDX even though at the moment they report the exact same thing.
In future PR, we intend to extract where packages has been found during the extraction process (file, line, column), which is an information only supported by CycloneDX 1.5.
We need a CycloneDX 1.4 format for backward compatibility reasons.
Additional informations
You may want to review this PR commit by commit, as it should be easier to read