search

oss-review-toolkit / ort

A suite of tools to automate software compliance checks.
https://oss-review-toolkit.org
Apache License 2.0
1.61k stars 313 forks source link

Support SCANOSS as a vulnerability advisor #7732

Open tsteenbe opened 1 year ago

tsteenbe commented 1 year ago

SCANOSS has a GRPC Vulnerability API which supports querying by package url (PURL) and including code repository package url. This makes it a very useful provider for C/C++ projects who know which OSS they use and want to know if there any known vulnerabilities

Example vulnerability query using SCANOSS python client

scanoss-py comp vulns -p "pkg:github/openssl/openssl@1.1.1l"

Vulnerability API is a bit hidden in their scanoss-py https://github.com/scanoss/scanoss.py/blob/main/src/scanoss/scanossgrpc.py#L253. Have spoken to @juliancoccia and he have a big 👍 for us to create a SCANOSS provider.

Below a ORT-based vulnerability process we were thinking of:

  1. Dev team uses ORT Helper CI to generate a analyzer result from a package list YAML file e.g. orth create-analyzer-result-from-package-list -i "$c-c++_project_file" --ort-file analyzer-result.json --config "$HOME/.ort/config/config.yml". Package list must have package urls for each dependency
  2. SCANOSS ORT Advisor looks up known vulnerabilities based package urls in ORT analyzer result file.
tsteenbe commented 1 year ago

Note that the SCANOSS API also can provide export control and health metrics - although interesting I propose we do not include these in the first iteration of this new advisor.

sschuberth commented 1 year ago

Where does the raw vulnerability data in SCANOSS come from @juliancoccia? It would only really make sense for us to add a SCANOSS advisor if it'd cover sources not already covered by OSV or VulnerableCode.

juliancoccia commented 1 year ago

Our sources are OSV and NVD and we have a team of curators maintaining PURL->CPE relationships daily. This dataset is made available as open data:

https://github.com/scanoss/purl2cpe

Moreover, our curators also connect PURL <-> PURL which allows you to find vulnerabilities (and other layers of data) regardless of which PURL (from which repo) you use to query the API.