diff --git a/build/Dockerfile b/build/Dockerfile index ab9856b..aed8dfd 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -1,18 +1,15 @@ -FROM debian:slim-bullseye +FROM alpine:latest ARG TARGETARCH # We will use this directory for downloads WORKDIR /opt -# Update and install necessary packages -RUN apt-get update && apt-get install -y --no-install-recommends \ - curl wget git cmake unzip clang ruby ruby-dev \ - ca-certificates openssl unzip openjdk-11-jdk \ - nodejs npm \ - && rm -rf /var/lib/apt/lists/* +# APK requires you to use --no-cache instead of -y and --no-install-recommends +RUN apk --no-cache add curl wget git cmake unzip clang ruby ruby-dev ruby-irb ruby-rake bash ruby-io-console ruby-bigdecimal ca-certificates wget openssl unzip openjdk11 -# Update npm to latest version +# Node.js and npm setup +RUN apk --no-cache add nodejs npm RUN npm install -g npm@latest # Ruby and Gems setup @@ -29,7 +26,7 @@ ENV PATH="/usr/local/go/bin:${PATH}" # Android SDK setup ENV ANDROID_HOME=/opt/android-sdk-linux -ENV JAVA_HOME="/usr/lib/jvm/java-11-openjdk-${TARGETARCH}" +ENV JAVA_HOME="/usr/lib/jvm/java-11-openjdk" RUN mkdir -p ${ANDROID_HOME}/cmdline-tools && \ wget https://dl.google.com/android/repository/commandlinetools-linux-7583922_latest.zip && \ diff --git a/integration/test/bomtools/bom-to-merge-1.json b/integration/test/bomtools/bom-to-merge-1.json index 330aead..c26121d 100644 --- a/integration/test/bomtools/bom-to-merge-1.json +++ b/integration/test/bomtools/bom-to-merge-1.json @@ -1,21 +1,16 @@ { + "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:4305f387-f85e-4ed2-8b3c-f7f7bea7de89", "version": 1, "metadata": { "timestamp": "2022-04-12T11:52:19Z", - "tools": [ - { - "vendor": "anchore", - "name": "syft", - "version": "0.43.2" - } - ], "component": { - "bom-ref": "c064c5755f84ac3d", - "type": "file", - "name": "/tmp/ruby-repos/anonymous_rate_response" + "type": "application", + "author": "anchore", + "name": "syft", + "version": "0.43.2" } }, "components": [ @@ -375,4 +370,4 @@ ] } ] -} +} \ No newline at end of file diff --git a/integration/test/bomtools/bom-to-merge-2.json b/integration/test/bomtools/bom-to-merge-2.json index 0e05897..137edd1 100644 --- a/integration/test/bomtools/bom-to-merge-2.json +++ b/integration/test/bomtools/bom-to-merge-2.json @@ -1,28 +1,19 @@ { + "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", - "specVersion": "1.4", + "specVersion": "1.5", "serialNumber": "urn:uuid:938b16ac-d9a0-4620-a7e4-bec83ff26ffb", "version": 1, "metadata": { "timestamp": "2022-04-12T11:52:58.780288Z", - "tools": [ - { - "vendor": "aquasecurity", - "name": "trivy", - "version": "0.25.3" - } - ], - "component": { - "bom-ref": "62488c47-9373-46be-b003-0583e5e3850b", + "component": + { "type": "application", - "name": "/tmp/ruby-repos/anonymous_rate_response", - "properties": [ - { - "name": "aquasecurity:trivy:SchemaVersion", - "value": "2" - } - ] + "author": "aquasecurity", + "name": "trivy", + "version": "0.25.3" } + }, "components": [ { @@ -150,4 +141,4 @@ } ], "vulnerabilities": [] -} +} \ No newline at end of file diff --git a/integration/test/bomtools/bom-to-merge-3.json b/integration/test/bomtools/bom-to-merge-3.json index c411e01..f19c781 100644 --- a/integration/test/bomtools/bom-to-merge-3.json +++ b/integration/test/bomtools/bom-to-merge-3.json @@ -1,23 +1,17 @@ { + "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:72861be8-8e26-483b-aef2-8f87eef986fb", "version": 1, "metadata": { "timestamp": "2022-04-12T11:56:11.107Z", - "tools": [ - { - "vendor": "AppThreat", - "name": "cdxgen", - "version": "4.0.8" - } - ], - "authors": [ - { - "name": "Team AppThreat", - "email": "cloud@appthreat.com" - } - ] + "component": { + "type": "application", + "author": "AppThreat", + "name": "cdxgen", + "version": "4.0.8" + } }, "components": [ { diff --git a/integration/test/bomtools/expected-merged-boms.json b/integration/test/bomtools/expected-merged-boms.json index 9806cdd..7842158 100644 --- a/integration/test/bomtools/expected-merged-boms.json +++ b/integration/test/bomtools/expected-merged-boms.json @@ -1,17 +1,17 @@ { + "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json", "bomFormat": "CycloneDX", - "specVersion": "1.4", + "specVersion": "1.5", "serialNumber": "urn:uuid:39d0ea34-b60b-475b-a21e-ba88f6bf3f9c", "version": 1, "metadata": { "timestamp": "2022-04-13T12:39:28+03:00", - "tools": [ - { - "vendor": "vinted", - "name": "sa-collector", - "version": "0.5.0" - } - ] + "component": { + "type": "application", + "author": "vinted", + "name": "sa-collector", + "version": "0.5.0" + } }, "components": [ { diff --git a/integration/test/bomtools/sample-bom.xml b/integration/test/bomtools/sample-bom.xml index 0d46c90..65a0be7 100644 --- a/integration/test/bomtools/sample-bom.xml +++ b/integration/test/bomtools/sample-bom.xml @@ -1,7 +1,9 @@ - - + + + + - + ckeditor 4.0.1 @@ -10,11 +12,9 @@ 0aaa1637e1c79e1ad75dbed0336f6647681d97fb80704da0c64e39854c124567 6c89cf1d0615d2d2214e1f06d63d51ac5535eb5e878bb6ffcc6f561d7133963a8a91b2af46fba29972ad3712762b107a088953cdb33c0c27645db5d00426235d - pkg:npm/ckeditor@4.0.1 - false - + jquery 2.1.4 @@ -23,9 +23,7 @@ b2215cce5830e2350b9d420271d9bd82340f664c3f60f0ea850f7e9c0392704e 28c3eb3b22a8c59eb74ddac7c989512b0197e9e5867bdf056018efeb9056687f44d86a04f555d8f8c9a3dd6296c014dc8708fae197839588c490ddc0eae27229 - pkg:npm/jquery@2.1.4 - false - + \ No newline at end of file diff --git a/pkg/bomtools/merge.go b/pkg/bomtools/merge.go index 6ecc2bb..9ce90d2 100644 --- a/pkg/bomtools/merge.go +++ b/pkg/bomtools/merge.go @@ -206,8 +206,17 @@ func mergeAllByPURL(component *cdx.Component, allComponents []*cdx.Component) *c mergedComponent.Properties = &p } if c.Licenses != nil { - l := mergeCollection[cdx.LicenseChoice](*c.Licenses, *mergedComponent.Licenses) - mergedComponent.Licenses = (*cdx.Licenses)(&l) + l := make([]cdx.LicenseChoice, 0) + for _, sl := range *c.Licenses { + // Check for license ID + if sl.License != nil && sl.License.ID != "" { + l = append(l, sl) + } + } + + // Assuming mergedComponent.Licenses is initialized properly earlier + mergedLicenses := mergeCollection[cdx.LicenseChoice](l, *mergedComponent.Licenses) + mergedComponent.Licenses = (*cdx.Licenses)(&mergedLicenses) } if c.ExternalReferences != nil { e := mergeCollection[cdx.ExternalReference](*c.ExternalReferences, *mergedComponent.ExternalReferences) diff --git a/pkg/collectors/jvm.go b/pkg/collectors/jvm.go index ef78c56..eefc985 100644 --- a/pkg/collectors/jvm.go +++ b/pkg/collectors/jvm.go @@ -70,7 +70,6 @@ func (j JVM) GenerateBOM(ctx context.Context, bomRoot string) (*cdx.BOM, error) SBOMs: []*cdx.BOM{singleModeBom, multiModeBom}, } return bomtools.MergeSBOMs(mergedSBOMparam) - } // BootstrapLanguageFiles implements LanguageCollector interface diff --git a/pkg/collectors/syft.go b/pkg/collectors/syft.go index 3ff38db..a9e4a7f 100644 --- a/pkg/collectors/syft.go +++ b/pkg/collectors/syft.go @@ -4,6 +4,7 @@ import ( "bytes" "context" "fmt" + "github.com/anchore/syft/syft/format/cyclonedxjson" log "github.com/sirupsen/logrus" diff --git a/pkg/dtrack/payloads.go b/pkg/dtrack/payloads.go index 9978429..63233c8 100644 --- a/pkg/dtrack/payloads.go +++ b/pkg/dtrack/payloads.go @@ -112,19 +112,3 @@ func (c updateSBOMsPayload) MarshalJSON() ([]byte, error) { "bom": base64.StdEncoding.EncodeToString([]byte(sbomsStr)), }) } - -func (c updateSBOMsPayload) MarshalJSONPayload(payload updateSBOMsPayload) ([]byte, error) { - sbomsStr, err := bomtools.CDXToString(payload.Sboms) - if err != nil { - return nil, fmt.Errorf("can't convert *cdx.BOM type Sboms to string") - } - - // project version is the SHA256 sum of all project tags concatenated with '/' + project name - versionHash := sha256.Sum256([]byte(strings.Join(append(payload.Tags, payload.ProjectName), "/"))) - - return json.Marshal(map[string]string{ - "projectName": payload.ProjectName, - "projectVersion": fmt.Sprintf("%x", versionHash), - "bom": base64.StdEncoding.EncodeToString([]byte(sbomsStr)), - }) -}