search

chainguard-dev / edu

Educational Resources for Software Supply Chain Security
https://edu.chainguard.dev
Other
72 stars 55 forks source link

Question on the chainguard courses #1571

Closed seniorchupon closed 1 month ago

seniorchupon commented 1 month ago

What topic are you requesting a resource about?

Proposed title:

Question on the chainguard courses

Description:

Hi all,

I am trying to go through the course here:

https://courses.chainguard.dev/vulnerability-management-certification/122276

In the section titled: Merging Existing VEX Documents, I am unable to complete these steps. Is there something wrong with my setup, or is the example document on this page incorrectly formatted?

This is what I get when I try and merge those two documents

vexctl merge --product=pkg:apk/wolfi/bash@1.0.0 \
             document1.vex.json \
             document2.vex.json
Error: merging documents: loading files: error loading file: unable to detect document format reading document1.vex.json
Usage:
  vexctl merge [flags]

Flags:
      --author string        author to record in the new document (default "Unknown Author")
      --author-role string   optional author role to record in the new document
  -h, --help                 help for merge
      --id string            ID string for the new VEX document (autogenerated by default)
      --product strings      list of products purls or other IRIs
      --vuln strings         list of vulnerability identifiers

Global Flags:
      --log-level string   the logging verbosity, either 'panic', 'fatal', 'error', 'warning', 'info', 'debug', 'trace' (default "info")

FATA merging documents: loading files: error loading file: unable to detect document format reading document1.vex.json

If I use the example files in examples/openvex I can perform the merge operation without issue.

Sorry if this is wrong place to post a question, but I didn't know where else to raise this up.

Thanks.

sheesh commented 1 month ago

Hi there -- thanks for flagging! I'll look into it and follow up shortly.

sheesh commented 1 month ago

@seniorchupon - I've swapped out the example files. The exercise should now work. Thanks for flagging!

ltagliaferri commented 1 month ago

Thanks for reporting this @seniorchupon

I have updated the tutorial on Academy that the course tutorial is based on. It seems that the format for the .vex.json file has changed since the previous time of writing, and it was not something on your end! Feel free to try the merge section again.