Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[feature] Adds a parser for CycloneDX Vex data #1181

Merged
merged 12 commits into from
Aug 31, 2023
Merged

[feature] Adds a parser for CycloneDX Vex data #1181

merged 12 commits into from
Aug 31, 2023

Conversation

stevemenezes
Copy link
Contributor

@stevemenezes stevemenezes commented Aug 23, 2023 •
edited
Loading

Description of the PR

Addresses #1148

PR Checklist

  • All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
  • All new changes are covered by tests
  • If GraphQL schema is changed, make generate has been run
  • If collectsub protobuf has been changed, make proto has been run
  • All CI checks are passing (tests and formatting)
  • All dependent PRs have already been merged

@stevemenezes
cdx-vex parser init
8d63acb 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes stevemenezes force-pushed the smenezes/cdx-vex-parser branch from 97be785 to 8d63acb Compare August 23, 2023 22:41
pxp928
pxp928 reviewed Aug 24, 2023
View reviewed changes
Copy link
Collaborator

@pxp928 pxp928 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good start! Left some comments for you and the other maintainers to get consensus on how we want to handle the status and justification bits

pkg/ingestor/parser/parser.go Outdated Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Show resolved Hide resolved
@stevemenezes
Merge remote-tracking branch 'origin/main' into smenezes/cdx-vex-parser
d20dd14
@stevemenezes
adds guesser and processor for cdx-vex along with vuln metadata
44e8cf4 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes
adds license info and removes unreachable code
9dce0e0 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes
fix linting issues
f63da56 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes stevemenezes force-pushed the smenezes/cdx-vex-parser branch from d52aaa8 to f63da56 Compare August 25, 2023 19:52
pxp928
pxp928 reviewed Aug 25, 2023
View reviewed changes
Copy link
Collaborator

@pxp928 pxp928 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Making progress! Added some comments!

pkg/assembler/graphql/schema/certifyVEXStatement.graphql Outdated Show resolved Hide resolved
pkg/assembler/graphql/schema/certifyVEXStatement.graphql Outdated Show resolved Hide resolved
pkg/handler/processor/cdx_vex/cdx_vex.go Show resolved Hide resolved
pkg/handler/processor/guesser/type_cdx_vex.go Outdated Show resolved Hide resolved
pkg/handler/processor/guesser/type_cyclonedx.go Outdated Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Show resolved Hide resolved
@stevemenezes
addresses comments around enums and adds a test for cdx-vex guesser
88e5df3 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes
adds unit tests for cdx-vex parser
91c7dec 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes
fix linting issues
7d73cbc 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes
fix unit tests
a63c835 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes stevemenezes marked this pull request as ready for review August 30, 2023 16:56
@stevemenezes
nit typo
db18cc2 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
pxp928
pxp928 reviewed Aug 30, 2023
View reviewed changes
Copy link
Collaborator

@pxp928 pxp928 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good! Added some comments

internal/testing/testdata/exampledata/cyclonedx-unaffected-vex.json Outdated Show resolved Hide resolved
internal/testing/testdata/exampledata/cyclonedx-vex-affected.json Outdated Show resolved Hide resolved
internal/testing/testdata/testdata.go Outdated Show resolved Hide resolved
internal/testing/testdata/testdata.go Outdated Show resolved Hide resolved
internal/testing/testdata/testdata.go Outdated Show resolved Hide resolved
pkg/handler/processor/cdx_vex/cdx_vex.go Show resolved Hide resolved
pkg/handler/processor/cdx_vex/cdx_vex_test.go Outdated Show resolved Hide resolved
pkg/handler/processor/guesser/type_cyclonedx_test.go Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Outdated Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Outdated Show resolved Hide resolved
lumjjb
lumjjb approved these changes Aug 30, 2023
View reviewed changes
Copy link
Contributor

@lumjjb lumjjb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor nits, else LGTM, + parth's comments. Awesome work! @stevemenezes

pkg/handler/processor/guesser/type_cyclonedx.go Show resolved Hide resolved
pkg/handler/processor/guesser/type_cyclonedx_test.go Show resolved Hide resolved
pkg/ingestor/parser/cdx_vex/parser_cdx_vex.go Show resolved Hide resolved
@stevemenezes
address nits, adds cdx-vex xml and relevant tests
ae32d49 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes
fix tests
7dc8f50 
Signed-off-by: stevemenezes <steve.menezes@yahooinc.com>
@stevemenezes stevemenezes mentioned this pull request Aug 31, 2023
Open
@kodiakhq kodiakhq bot merged commit 8634dd5 into guacsec:main Aug 31, 2023
8 of 9 checks passed
@stevemenezes stevemenezes deleted the smenezes/cdx-vex-parser branch August 31, 2023 17:06
@stevemenezes stevemenezes mentioned this pull request Sep 11, 2023
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pxp928 pxp928 pxp928 left review comments

@lumjjb lumjjb lumjjb approved these changes

@mihaimaruseac mihaimaruseac mihaimaruseac approved these changes

Assignees
No one assigned
Labels
size/XXL
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@stevemenezes @mihaimaruseac @lumjjb @pxp928