feat: add package for go compiler given binary detection #2195
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
spiffcs
force-pushed
the
go-compiler-version
branch
from
dbd651d to
fb3afc9
Compare
Signed-off-by: Christopher Phillips <[email protected]>
spiffcs
force-pushed
the
go-compiler-version
branch
from
fb3afc9 to
1ca17dd
Compare
Signed-off-by: Christopher Phillips <[email protected]>
spiffcs
force-pushed
the
go-compiler-version
branch
from
eec4e80 to
5617c1b
Compare
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
spiffcs
force-pushed
the
go-compiler-version
branch
from
a0dce54 to
0d0d16c
Compare
|
Blocked on #2201 Will merge after review and 2201 is merged into main |
Signed-off-by: Christopher Phillips <[email protected]>
GijsCalis
pushed a commit
to GijsCalis/syft
that referenced
this pull request
Feb 19, 2024
adds a unique synthetic package to the SBOM output that represents the go compiler when it is detected as a part of a package discovered by the go binary cataloger. When using an SBOM generated by syft - downstream vulnerability scanners now have the opportunity to detect/report on the PURL/CPEs attached to the new stdlib package. --------- Signed-off-by: Christopher Phillips <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Syft currently has a Golang binary cataloger. This PR adds a unique synthetic package to the SBOM output that represents the go compiler when detected as a part of the go binary cataloger.
When using an SBOM generated by syft - downstream vulnerability scanners now have the opportunity to detect/report on the PURL/CPEs attached to the new package.
One more piece of work should be doing a bit more string parsing on the go version to identify rc and other candidate releases to improve CPE generation. I'll make those changes before we review.
Closes #1853