Annotation improvements - part 5 (#1455)

* Where the sbom is describing a container, use the tagging information from obom Signed-off-by: Prabhu Subramanian <[email protected]> --------- Signed-off-by: Prabhu Subramanian <[email protected]>
CycloneDX · Nov 14, 2024 · 8c4c8ec · 8c4c8ec
1 parent 3b4b2fe
commit 8c4c8ec
Show file tree

Hide file tree

Showing 7 changed files with 64 additions and 28 deletions.
diff --git a/data/component-tags.json b/data/component-tags.json
@@ -231,8 +231,10 @@
   },
   "name": {
     "sbom": [
-      { "test": ["(junit|xmlunit|testng|chai|mocha|jest)"] },
-      { "security": ["(boringssl|openssl|libressl|gnutls|jose|keyutils)"] },
+      { "test": ["(junit|xmlunit|testng|chai|mocha|jest|test4j)"] },
+      {
+        "security": ["(boringssl|openssl|libressl|libssl|gnutls|jose|keyutils)"]
+      },
       { "native": ["(ffi|native)"] },
       { "parse": ["(parser)"] },
       { "transform": ["(transformer)"] }
@@ -241,7 +243,7 @@
       {
         "devel": [
           "-(dev|devel|headers|sdk|libs|extension|headers+x86|headers+x64|headers+arm64)$",
-          "^(git)-",
+          "^(git)[-]?",
           "^(sdk|windows+sdk)"
         ]
       },
@@ -253,7 +255,7 @@
       { "kernel": ["^(linux|kernel|os-image)"] },
       {
         "security": [
-          "(selinux|apparmor|security|boringssl|openssl|libressl|gnutls|jose|keyutils|passwd)"
+          "(selinux|apparmor|security|boringssl|openssl|libressl|gnutls|jose|keyutils|passwd|libssl|libaudit|gcrypt|libpam|libseccomp)"
         ]
       },
       {
@@ -262,33 +264,48 @@
         ]
       },
       {
-        "build": ["(cpp|fortran|gcc|make|meson|bazel|maven|gradle|sbt|ant|gdb)"]
+        "build": [
+          "(cpp|fortran|gcc|make|meson|bazel|maven|gradle|sbt|ant|gdb|boost|compiler|kotlin|cargo|rustc|llvm|libstdc)"
+        ]
       },
       {
         "network": [
-          "(tailscale|wireguard|openvpn|dns|cockpit|cups|dhcp|network|iproute|iptables|mosh|netavark|openssh|rsync|tcpdump)"
+          "(tailscale|wireguard|openvpn|dns|cockpit|cups|dhcp|network|iproute|iptables|mosh|netavark|openssh|rsync|tcpdump|libssh)"
+        ]
+      },
+      { "webserver": ["(httpd|http2|tomcat|jboss)"] },
+      {
+        "crypto": [
+          "(crypt|gpg|keys|certificates|gnupg|certifi|pubkey|keyutils|nss|keyring)"
         ]
       },
-      { "webserver": ["(httpd|http2)"] },
-      { "crypto": ["(crypt|gpg|keys|certificates|gnupg|certifi)"] },
       { "repository": ["(-repos|-release|ostree|appstream)"] },
-      { "shell": ["(bash|zsh|csh|fish)"] },
+      { "shell": ["(bash|zsh|csh|fish|binsh|dash|oilsh)"] },
       { "bluetooth": ["(bluez|bluetooth)"] },
       { "sound": ["(alsa|pulseaudio|wireplumber|flac|codecs|ldac|sound)"] },
-      { "compression": ["(brotli|xz-utils|zstd|lz4)", "(tar|zip|webp)$"] },
+      {
+        "compression": [
+          "(brotli|xz-utils|zstd|lz4|zlib|bz2|lzma5|bzip2|libarchive)",
+          "(tar|zip|webp|zchunk)$"
+        ]
+      },
       {
         "runtime": [
-          "(perl|lua|php|python|ruby|dotnet|java|swift|runtime|glibc|musl|wasm|.net|asp.net|node.js|node)"
+          "(perl|lua|php|python|ruby|dotnet|java|swift|runtime|glibc|libc6|musl|wasm|\\.net|asp\\.net|node.js|node|groovy)"
         ]
       },
       { "editor": ["(vim|emacs|nano|hexedit)"] },
       { "xml": ["(xml|expat)"] },
-      { "boot": ["(grub|systemd-boot|syslinux)"] },
-      { "gui": ["(wayland|xorg|X11|mesa|vulkan|tk|wkhtmltox|electron)"] },
+      { "boot": ["(grub|systemd-boot|syslinux|init-system|sysvinit)"] },
+      {
+        "gui": [
+          "(wayland|xorg|X11|mesa|vulkan|tk|wkhtmltox|electron|Xrender|glib2)"
+        ]
+      },
       {
         "package": [
-          "(rpm|dnf|yum|apt|zypper|apk|conda)$",
-          "^(conda_package_|conda-package-)"
+          "(rpm|dnf|yum|apt|zypper|apk|conda|dpkg|dnf5)$",
+          "^(conda_package_|conda-package-|libapt|dnf5-|libdnf5)"
         ]
       },
       {
@@ -298,7 +315,11 @@
           "(microsoft+edge|microsoft+edge+webview2|microsoft+html)"
         ]
       },
-      { "chat": ["(webex|teams|slack|discord|vesktop|matrix|signal|whatsapp)"] }
+      {
+        "chat": ["(webex|teams|slack|discord|vesktop|matrix|signal|whatsapp)"]
+      },
+      { "logging": ["(log4j|logging|slf4j)"] },
+      { "root": ["^(sudo|systemd|pam|shadow)$"] }
     ]
   }
 }
diff --git a/lib/managers/docker.js b/lib/managers/docker.js
@@ -777,6 +777,7 @@ export const extractTar = async (fullImageName, dir) => {
             path.includes("usr/share/zoneinfo/") ||
             path.includes("usr/share/doc/") ||
             path.includes("usr/share/i18n/") ||
+            path.includes("var/lib/ca-certificates") ||
             basename(path).startsWith(".") ||
             path.includes("usr/share/licenses/device-mapper-libs") ||
             [

diff --git a/lib/stages/postgen/annotator.js b/lib/stages/postgen/annotator.js
@@ -253,28 +253,40 @@ export function textualMetadata(bomJson) {
  *
  * @param {Object} component CycloneDX component
  * @param {String} bomType BOM type
+ * @param {String} parentComponentType Parent component type
+ *
  * @returns {Array | undefined} Array of string tags
  */
-export function extractTags(component, bomType = "all") {
+export function extractTags(
+  component,
+  bomType = "all",
+  parentComponentType = "application",
+) {
   if (
     !component ||
     (!component.description && !component.properties && !component.name)
   ) {
     return undefined;
   }
+  bomType = bomType?.toLowerCase();
   const tags = new Set();
   const desc = component?.description?.toLowerCase();
   const compProps = component.properties || [];
   // Collect both the BOM specific tags and all tags
-  const compNameTags = (componentTags.name[bomType.toLowerCase()] || []).concat(
+  let compNameTags = (componentTags.name[bomType] || []).concat(
     componentTags.name.all || [],
   );
-  const compDescTags = (
-    componentTags.description[bomType.toLowerCase()] || []
-  ).concat(componentTags.description.all || []);
-  const compPropsTags = (
-    componentTags.properties[bomType.toLowerCase()] || []
-  ).concat(componentTags.properties.all || []);
+  // For SBOMs with a container component as parent, utilize the tags
+  // from OBOM
+  if (bomType === "sbom" && parentComponentType === "container") {
+    compNameTags = compNameTags.concat(componentTags.name.obom || []);
+  }
+  const compDescTags = (componentTags.description[bomType] || []).concat(
+    componentTags.description.all || [],
+  );
+  const compPropsTags = (componentTags.properties[bomType] || []).concat(
+    componentTags.properties.all || [],
+  );
   if (component?.name) {
     // {"devel": ["/-(dev|devel|headers)$/"]}
     for (const anameTagObject of compNameTags) {

diff --git a/lib/stages/postgen/postgen.js b/lib/stages/postgen/postgen.js
@@ -355,7 +355,7 @@ export function annotate(bomJson, options) {
   }
   // Tag the components
   for (const comp of bomJson.components) {
-    const tags = extractTags(comp, bomType);
+    const tags = extractTags(comp, bomType, bomJson.metadata?.component?.type);
     if (tags?.length) {
       comp.tags = tags;
     }

diff --git a/types/lib/managers/docker.d.ts.map b/types/lib/managers/docker.d.ts.map
diff --git a/types/lib/stages/postgen/annotator.d.ts b/types/lib/stages/postgen/annotator.d.ts
@@ -19,7 +19,9 @@ export function textualMetadata(bomJson: any): string | undefined;
  *
  * @param {Object} component CycloneDX component
  * @param {String} bomType BOM type
+ * @param {String} parentComponentType Parent component type
+ *
  * @returns {Array | undefined} Array of string tags
  */
-export function extractTags(component: any, bomType?: string): any[] | undefined;
+export function extractTags(component: any, bomType?: string, parentComponentType?: string): any[] | undefined;
 //# sourceMappingURL=annotator.d.ts.map
diff --git a/types/lib/stages/postgen/annotator.d.ts.map b/types/lib/stages/postgen/annotator.d.ts.map