search

sonatype / ossindex-public

Sonatype OSS Index - Public
Apache License 2.0
6 stars 9 forks source link

Scanning RPM packages for vulnerabilities #26

Closed itsecforu closed 2 years ago

itsecforu commented 3 years ago

Hey folks!

How do correctly scanning rpm packages ?

Maybe you have some kind of page with examples or even a wiki?

Internet search gave no results

ndonewar commented 3 years ago

Hi!

OSS Index uses the Package URL (purl) specification for packages (components). Here's a link with info: https://ossindex.sonatype.org/doc/coordinates

The URL of each component on the OSS Index website contains the purl. You can browse a list of rpm components here: https://ossindex.sonatype.org/browse/rpm?page=0

An easy way to try out the OSS Index API is via this page: https://ossindex.sonatype.org/rest

Note that the API requires a version number for each purl. For example, here's a specific version of a component: https://ossindex.sonatype.org/component/pkg:rpm/nginx@1.10.1

The purl starts with "pkg:", so the purl is pkg:rpm/nginx@1.10.1.

A request to the API for that purl would be the following:

{
  "coordinates": [
    "pkg:rpm/nginx@1.10.1"
  ]
}

Up to 128 purls per request are allowed (add additional ones to the "coordinates" array above).

itsecforu commented 3 years ago

Hi, thx for feedback.