diff --git a/bin/cdxgen.js b/bin/cdxgen.js index f2ed93f53..a699cf3d4 100755 --- a/bin/cdxgen.js +++ b/bin/cdxgen.js @@ -774,7 +774,6 @@ const checkPermissions = (filePath) => { printTable(bomNSData.bomJson); // CBOM related print if (options.includeCrypto) { - console.log("\n*** Cryptography BOM ***"); printTable(bomNSData.bomJson, ["cryptographic-asset"]); printDependencyTree(bomNSData.bomJson, "provides"); } diff --git a/lib/stages/postgen/postgen.js b/lib/stages/postgen/postgen.js index 438f20c95..7c6522ea2 100644 --- a/lib/stages/postgen/postgen.js +++ b/lib/stages/postgen/postgen.js @@ -306,7 +306,7 @@ export function annotate(bomJson, options) { if (!cdxgenAnnotator.length) { return bomJson; } - const requiresContextTrimming = ["ml-tiny"].includes(options?.profile); + const { bomType } = findBomType(bomJson); const requiresContextTuning = [ "deep-learning", "machine-learning", @@ -314,6 +314,9 @@ export function annotate(bomJson, options) { "ml-deep", "ml-tiny", ].includes(options?.profile); + const requiresContextTrimming = + (requiresContextTuning && ["saasbom"].includes(bomType.toLowerCase())) || + ["ml-tiny"].includes(options?.profile); // Construct the bom-link prefix to use for context tuning const bomLinkPrefix = `${bomJson.serialNumber}/${bomJson.version}/`; const metadataAnnotations = textualMetadata(bomJson); @@ -343,8 +346,13 @@ export function annotate(bomJson, options) { if (bomJson?.metadata?.component?.["bom-ref"]) { bomJson.metadata.component["bom-ref"] = undefined; } + if (bomJson?.metadata?.component?.properties) { + bomJson.metadata.component.properties = undefined; + } + if (bomJson?.metadata?.properties) { + bomJson.metadata.properties = undefined; + } } - const { bomType, bomTypeDescription } = findBomType(bomJson); // Tag the components for (const comp of bomJson.components) { const tags = extractTags(comp, bomType); @@ -372,6 +380,13 @@ export function annotate(bomJson, options) { // For tiny models, we can remove the dependencies section if (requiresContextTrimming) { bomJson.dependencies = undefined; + if (bomType.toLowerCase() === "saasbom") { + bomJson.components = undefined; + let i = 0; + for (const aserv of bomJson.services) { + aserv.name = `service-${i++}`; + } + } } // Problem: information such as the dependency tree are specific to an sbom // To prevent the models from incorrectly learning about the trees, we automatically convert all bom-ref diff --git a/types/lib/stages/postgen/postgen.d.ts.map b/types/lib/stages/postgen/postgen.d.ts.map index 455ff16a4..d92a077e9 100644 --- a/types/lib/stages/postgen/postgen.d.ts.map +++ b/types/lib/stages/postgen/postgen.d.ts.map @@ -1 +1 @@ -{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAaA;;;;;;;GAOG;AACH,+DAkBC;AAED;;;;;;;GAOG;AACH,gEAqCC;AAED;;;;;;;GAOG;AACH,gEA+BC;AAED;;;;;;;GAOG;AACH,2DAyIC;AAED;;GAEG;AACH,gDAIC;AAMD;;;;;;;GAOG;AACH,0DAoGC"} \ No newline at end of file +{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../../../../lib/stages/postgen/postgen.js"],"names":[],"mappings":"AAaA;;;;;;;GAOG;AACH,+DAkBC;AAED;;;;;;;GAOG;AACH,gEAqCC;AAED;;;;;;;GAOG;AACH,gEA+BC;AAED;;;;;;;GAOG;AACH,2DAyIC;AAED;;GAEG;AACH,gDAIC;AAMD;;;;;;;GAOG;AACH,0DAmHC"} \ No newline at end of file