search

oss-review-toolkit / ort

A suite of tools to automate software compliance checks.
https://oss-review-toolkit.org
Apache License 2.0
1.57k stars 308 forks source link

Support SCANOSS as a vulnerability advisor #7732

Open tsteenbe opened 11 months ago

tsteenbe commented 11 months ago

SCANOSS has a GRPC Vulnerability API which supports querying by package url (PURL) and including code repository package url. This makes it a very useful provider for C/C++ projects who know which OSS they use and want to know if there any known vulnerabilities

Example vulnerability query using SCANOSS python client

scanoss-py comp vulns -p "pkg:github/openssl/openssl@1.1.1l"

Vulnerability API is a bit hidden in their scanoss-py https://github.com/scanoss/scanoss.py/blob/main/src/scanoss/scanossgrpc.py#L253. Have spoken to @juliancoccia and he have a big 👍 for us to create a SCANOSS provider.

Below a ORT-based vulnerability process we were thinking of:

  1. Dev team uses ORT Helper CI to generate a analyzer result from a package list YAML file e.g. orth create-analyzer-result-from-package-list -i "$c-c++_project_file" --ort-file analyzer-result.json --config "$HOME/.ort/config/config.yml". Package list must have package urls for each dependency
  2. SCANOSS ORT Advisor looks up known vulnerabilities based package urls in ORT analyzer result file.
tsteenbe commented 11 months ago

Note that the SCANOSS API also can provide export control and health metrics - although interesting I propose we do not include these in the first iteration of this new advisor.

sschuberth commented 11 months ago

Where does the raw vulnerability data in SCANOSS come from @juliancoccia? It would only really make sense for us to add a SCANOSS advisor if it'd cover sources not already covered by OSV or VulnerableCode.

juliancoccia commented 11 months ago

Our sources are OSV and NVD and we have a team of curators maintaining PURL->CPE relationships daily. This dataset is made available as open data:

https://github.com/scanoss/purl2cpe

Moreover, our curators also connect PURL <-> PURL which allows you to find vulnerabilities (and other layers of data) regardless of which PURL (from which repo) you use to query the API.