search

openvex / vexctl

A tool to create, transform and attest VEX metadata
Apache License 2.0
108 stars 21 forks source link

Add support to vulnerability aliases #220

Closed macedogm closed 2 months ago

macedogm commented 2 months ago

This is an initial implementation that adds support to vulnerability aliases as documented in the spec.

Note that support is only added when creating a new Vex document or adding a new statement. It doesn't support filtering or merging based on aliases.

Closes https://github.com/openvex/vexctl/issues/219

macedogm commented 2 months ago

@puerco thanks for the quick review and comments. Yes, I'll add the improvements that you requested, just a note that I'll have to travel for a few days, so there might be some delay before I update the PR.

puerco commented 2 months ago

@macedogm if you need this change we can handle the validation in a follow up. If you need this one quickly, just rebase the PR, we merge it and I can add the validation logic :)

macedogm commented 2 months ago

@puerco I can wait a few days, no rush on that. It's more up to you if you prefer to merge this one quickly and do the rest on a follow up PR.

puerco commented 2 months ago

Ah the linter is not happy, otherwise LGTM

macedogm commented 2 months ago

@puerco hopefully I addressed your comments. PTAL and let me know if the style is as expected.

Additionally, should we consider adding a validation in internal/cmd/add.go to check if an alias being added is repeated with another aliases or vulnerabilities ID already present in the document? Would this validation make sense at the moment?

puerco commented 2 months ago

The vexStatementOptions are embedded in the addOptions, so your change should work in both :)

https://github.com/openvex/vexctl/blob/9bbf7cd70fc0d79f97ba21502aea40beec09f74d/internal/cmd/add.go#L36-L40

Thank you!