search

bgnetworks / meta-dependencytrack

A Yocto meta-layer for generating CycloneDX SBOMs and automatically uploading them to Dependency Track.
https://bgnet.works
Other
19 stars 22 forks source link

Handle components that have patches for CVE's #2

Open hellbent opened 2 years ago

hellbent commented 2 years ago

Right now a Yocto component may have a patch included in its recipe which addresses a CVE yet Dependency Track has no way of knowing and will still list it as being vulnerable. We should use the pedigree feature in CycloneDX to forward this info to DT as part of the BOM.

stevespringett commented 2 years ago

Related to https://github.com/DependencyTrack/dependency-track/issues/919

xRate1337 commented 2 years ago

What is the current status? Does it already work with the pedigree feature of CycloneDX? Or has someone already tried to pack it into a VEX file and attach it to the CycloneDX SBOM?

olsensteffen commented 1 year ago

What is the current status? Does it already work with the pedigree feature of CycloneDX? Or has someone already tried to pack it into a VEX file and attach it to the CycloneDX SBOM?

The current status is that the pedigree patches are not taken into account by DT. As a workaround I made a bbclass which generates both a sbom and a vex document, which are uploaded to DT by CI, and this works great

svenschwermer commented 1 year ago

What is the current status? Does it already work with the pedigree feature of CycloneDX? Or has someone already tried to pack it into a VEX file and attach it to the CycloneDX SBOM?

The current status is that the pedigree patches are not taken into account by DT. As a workaround I made a bbclass which generates both a sbom and a vex document, which are uploaded to DT by CI, and this works great

Would you be comfortable sharing that class?

groetingc commented 1 year ago

I just would like to ask, if You would be so kind and share the class with VEX generation also with me? Could You probably share an example of a generated VEX file?

Jasper-Ben commented 1 year ago

I have a working POC for this (using VEX), however currently blocked by https://github.com/bgnetworks/meta-dependencytrack/issues/4.