Skip to content

Use Java package names to determine known groupIDs#2032

Merged
kzantow merged 4 commits into
mainfrom
feat/spring-groupid
Aug 17, 2023
Merged

Use Java package names to determine known groupIDs#2032
kzantow merged 4 commits into
mainfrom
feat/spring-groupid

Conversation

@kzantow
Copy link
Copy Markdown
Contributor

@kzantow kzantow commented Aug 16, 2023 •
edited
Loading

This PR adds a small curated list of known Java package names to groupIds, in order to properly generate PURLs for these archives, which do not contain Maven information.

With this change, Grype finds multiple GHSA entries against spring archives in one of the quality gate images, whereas before there were no GHSA matches:

NAME                                  INSTALLED                FIXED-IN                    TYPE            VULNERABILITY        SEVERITY 
spring-beans                          5.2.12.RELEASE           5.2.20.RELEASE              java-archive    GHSA-36p3-wjmg-h94x  Critical  
spring-core                           5.2.12.RELEASE           5.2.24.RELEASE              java-archive    GHSA-wxqc-pxw9-g2p8  High      
spring-core                           5.2.12.RELEASE           5.2.22.RELEASE              java-archive    GHSA-hh26-6xwr-ggv7  High      
spring-core                           5.2.12.RELEASE           5.2.21                      java-archive    GHSA-g5mm-vmx4-3rg7  High      
spring-core                           5.2.12.RELEASE           5.2.22.RELEASE              java-archive    GHSA-rqph-vqwm-22vc  Medium    
spring-core                           5.2.12.RELEASE           5.2.18                      java-archive    GHSA-rfmp-97jj-h8m6  Medium    
spring-core                           5.2.12.RELEASE           5.2.19                      java-archive    GHSA-6gf2-pvqw-37ph  Medium    
spring-core                           5.2.12.RELEASE           5.2.23.RELEASE              java-archive    GHSA-564r-hj7v-mcr5  Medium    
spring-expression                     5.2.12.RELEASE           5.2.20.RELEASE              java-archive    GHSA-558x-2xjg-6232  Medium    
spring-security-core                  5.4.4                    5.5.7                       java-archive    GHSA-hh32-7344-cg2f  Critical  
spring-security-core                  5.4.4                    5.4.7                       java-archive    GHSA-w9jg-gvgr-354m  High      
spring-security-core                  5.4.4                    5.5.7                       java-archive    GHSA-wx54-3278-m5g4  Medium    
spring-web                            5.2.12.RELEASE           6.0.0                       java-archive    GHSA-4wrc-f8pq-fpqp  Critical  
spring-web                            5.2.12.RELEASE           5.2.15                      java-archive    GHSA-gfwj-fwqj-fp3v  High

@kzantow
feat: use java package names to determine known groupids
e0e33b8 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Aug 16, 2023 •
edited
Loading

Benchmark Test Results

Benchmark results from the latest changes vs base branch 
goos: linux%0Agoarch: amd64%0Apkg: github.com/anchore/syft/test/integration%0Acpu: Intel(R) Xeon(R) Platinum 8370C CPU @ 2.80GHz%0A                                                              │ ./.tmp/benchmark-db92036.txt │%0A                                                              │            sec/op            │%0AImagePackageCatalogers/alpmdb-cataloger-2                                       12.15m ±  2%25%0AImagePackageCatalogers/apkdb-cataloger-2                                        678.7µ ±  1%25%0AImagePackageCatalogers/binary-cataloger-2                                       207.5µ ±  0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                       572.9µ ±  1%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                   20.93µ ±  1%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                             93.95µ ±  1%25%0AImagePackageCatalogers/java-cataloger-2                                         13.51m ±  1%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                         92.27µ ± 19%25%0AImagePackageCatalogers/javascript-package-cataloger-2                           351.7µ ±  1%25%0AImagePackageCatalogers/nix-store-cataloger-2                                    256.8µ ±  2%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                       746.5µ ±  1%25%0AImagePackageCatalogers/portage-cataloger-2                                      423.9µ ±  1%25%0AImagePackageCatalogers/python-package-cataloger-2                               3.221m ±  1%25%0AImagePackageCatalogers/r-package-cataloger-2                                    181.5µ ±  1%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                       485.8µ ±  1%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                 851.1µ ±  1%25%0AImagePackageCatalogers/sbom-cataloger-2                                         117.7µ ±  0%25%0Ageomean                                                                         461.5µ%0A%0A                                                              │ ./.tmp/benchmark-db92036.txt │%0A                                                              │             B/op             │%0AImagePackageCatalogers/alpmdb-cataloger-2                                       5.143Mi ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                        205.1Ki ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                       30.54Ki ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                       172.8Ki ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                   3.697Ki ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                             9.906Ki ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                         2.825Mi ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                         8.594Ki ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                           94.35Ki ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                    49.33Ki ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                       186.3Ki ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                      120.2Ki ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                               1.004Mi ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                    53.29Ki ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                       181.5Ki ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                 144.2Ki ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                         14.21Ki ± 0%25%0Ageomean                                                                         100.6Ki%0A%0A                                                              │ ./.tmp/benchmark-db92036.txt │%0A                                                              │          allocs/op           │%0AImagePackageCatalogers/alpmdb-cataloger-2                                        88.14k ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                         4.190k ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                         848.0 ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                        3.145k ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                     132.0 ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                               281.0 ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                          40.63k ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                           228.0 ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                            1.342k ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                      898.0 ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                        4.079k ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                       2.272k ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                                16.44k ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                      929.0 ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                        3.992k ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                  2.447k ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                           394.0 ± 0%25%0Ageomean                                                                          2.063k

@kzantow kzantow added enhancement New feature or request bug Something isn't working and removed bug Something isn't working labels Aug 16, 2023
This was referenced Aug 17, 2023
Closed
Merged
spiffcs
spiffcs reviewed Aug 17, 2023
View reviewed changes
Comment thread syft/pkg/cataloger/common/cpe/java.go
kzantow added 3 commits August 17, 2023 11:44
@kzantow
Merge remote-tracking branch 'origin/main' into feat/spring-groupid
5ed48bc
@kzantow
chore: PR feedback
4411273 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
@kzantow
chore: add apache ant groupIDs
86c096e 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
westonsteimel
westonsteimel approved these changes Aug 17, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@westonsteimel westonsteimel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes sense to me as an initial step to handle ones we know for certain are incorrect and popular. Thanks @kzantow!

@kzantow kzantow merged commit 4762ba0 into main Aug 17, 2023
@kzantow kzantow deleted the feat/spring-groupid branch August 17, 2023 16:55
@kzantow kzantow added bug Something isn't working and removed enhancement New feature or request labels Aug 17, 2023
@kzantow kzantow changed the title feat: use java package names to determine known groupids Use Java package names to determine known groupIDs Aug 17, 2023
This was referenced Aug 18, 2023
Open
Closed
Closed
Closed
This was referenced Aug 28, 2023
Closed
Closed
Closed
GijsCalis pushed a commit to GijsCalis/syft that referenced this pull request Feb 19, 2024
@kzantow
feat: use java package names to determine known groupids (anchore#2032)
19e6b5e 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@spiffcs spiffcs spiffcs left review comments

@westonsteimel westonsteimel westonsteimel approved these changes

Assignees

No one assigned

Labels

bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kzantow @westonsteimel @spiffcs