advanced-security / crypto-bill-of-materials-data Goto Github PK

d6c28b3fc7ea206058fbe6f8dc4bfbb8131af336

d3d0f3ba4dc9256122f01ebdd4be4fae2a586df3

f8ee8adfdeb88e942d0919952d03e2fbfbc9a4b9

Hi,

The way information on the project being scanned is presented in the SARIF output is inconsistent with the format used in the MRVA repo. This is causing an issue when generating a CBOM from the output as the parser expects to be able to extract an identifier for the project

This Repo
The project name is extractable only from the automationDetails key:

"automationDetails" : {
    "id": "PQC:curzona/pytest-xdist/python/"
}

https://github.com/pre-quantum-research/pqc-data/blob/main/data/curzona/pytest-xdist/15db3ad1580211f1ecda2f129d101967dac02d67/python.sarif

MRVA Repo
The project name is extractable only from the versionControlProvenance key

"versionControlProvenance": [
    {
        "repositoryUri": "https://github.com/MaterializeInc/materialize",
        "revisionId": "0f612c8e670f07ccfbfc40f72ca2b3f3a3c0a485"
    }
]

https://github.com/pre-quantum-research/MRVA/blob/main/results/python/py_quantum_readiness_cbom_all_asymmetric_encryption_algorithms_(MaterializeInc_materialize).sarif

Please could we get clarification on how project information will be reported in the SARIF output going forwards, so that the parser can read the output accordingly?

Thanks

d6c28b3fc7ea206058fbe6f8dc4bfbb8131af336

93ebd83ecdbc5685f65225a22922b8dc394dddcc

b8e2a17de1aa76085df168a86dbb98ce53979faf

431f77ddb4194d5b3357c4b4126de1dc9dac6126