feat(advisor): Add BlackDuck as advisor #9652
Open
+6,239
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fviernau
force-pushed
the
initial-black-duck-advisor
branch
from
ef2e79e to
1e78d98
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
fviernau
force-pushed
the
initial-black-duck-advisor
branch
3 times, most recently
from
3eda163 to
951f01b
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #9652 +/- ##
=========================================
Coverage 68.10% 68.10%
Complexity 1294 1294
=========================================
Files 249 249
Lines 8841 8841
Branches 922 922
=========================================
Hits 6021 6021
Misses 2432 2432
Partials 388 388
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
sschuberth
reviewed
Dec 20, 2024
plugins/advisors/black-duck/src/funTest/kotlin/BlackDuckFunTest.kt
Outdated
Show resolved
Hide resolved
plugins/advisors/black-duck/src/funTest/kotlin/BlackDuckFunTest.kt
Outdated
Show resolved
Hide resolved
plugins/advisors/black-duck/src/funTest/kotlin/ResponseCachingComponentServiceClient.kt
Show resolved
Hide resolved
plugins/advisors/black-duck/src/main/kotlin/BlackDuckConfiguration.kt
Outdated
Show resolved
Hide resolved
plugins/advisors/black-duck/src/main/kotlin/ExtendedComponentService.kt
Outdated
Show resolved
Hide resolved
plugins/advisors/black-duck/src/funTest/kotlin/ResponseCachingComponentServiceClient.kt
Show resolved
Hide resolved
fviernau
force-pushed
the
initial-black-duck-advisor
branch
from
951f01b to
ddd2034
Compare
plugins/advisors/black-duck/src/funTest/kotlin/ResponseCachingComponentServiceClient.kt
Fixed
Show fixed
Hide fixed
fviernau
force-pushed
the
initial-black-duck-advisor
branch
from
ddd2034 to
aa40097
Compare
sschuberth
reviewed
Dec 20, 2024
sschuberth
reviewed
Dec 20, 2024
fviernau
force-pushed
the
initial-black-duck-advisor
branch
5 times, most recently
from
918d103 to
d154358
Compare
fviernau
force-pushed
the
initial-black-duck-advisor
branch
2 times, most recently
from
642d0bb to
fa916ac
Compare
sschuberth
requested changes
Dec 23, 2024
plugins/advisors/black-duck/src/funTest/kotlin/BlackDuckFunTest.kt
Outdated
Show resolved
Hide resolved
plugins/advisors/black-duck/src/funTest/kotlin/BlackDuckFunTest.kt
Outdated
Show resolved
Hide resolved
plugins/advisors/black-duck/src/main/kotlin/ExtendedComponentService.kt
Outdated
Show resolved
Hide resolved
fviernau
force-pushed
the
initial-black-duck-advisor
branch
from
fa916ac to
9b62a53
Compare
fviernau
force-pushed
the
initial-black-duck-advisor
branch
4 times, most recently
from
406bb8c to
2b0bfc7
Compare
sschuberth
requested changes
Dec 23, 2024
fviernau
force-pushed
the
initial-black-duck-advisor
branch
from
2b0bfc7 to
4e2d854
Compare
fviernau
force-pushed
the
initial-black-duck-advisor
branch
4 times, most recently
from
331b370 to
20e80da
Compare
BlackDuck's knowledge base about external components allows the
retrieval of vulnerabilities by either a `(component, version)` tuple
or an `origin`.
The implementation relies on querying the vulnerabilities solely based
on the origin, because that is what most closely resembles an ORT
identifier or a purl. Relying on (component, version) would
lead to unnecessary overreporting, let alone the difficulties with
finding a good match.
The implementation for now determines the origin by searching for it
via the purl. Considering the ecosystems currently present in ORT, this
works well for crate, gem, hackage, maven, npm, nuget, pod, pub and
pypi, see also [1].
Note: Not all origins do have a purl associated, but they always have
a `(externalNamespace, externalId)`. For such cases the
implementation should be enhanced to allow specifying the
`(externalNamespace, externalId)` via a curation.
[1]: #9638
Signed-off-by: Frank Viernau <x9fviern@zeiss.com>
Signed-off-by: Frank Viernau <x9fviern@zeiss.com>
Re-align the completions after adding the new BlackDuck advisor by running [1]. [1]: `/scripts/generate_completion_scripts.sh` Signed-off-by: Frank Viernau <x9fviern@zeiss.com>
Signed-off-by: Frank Viernau <x9fviern@zeiss.com>
fviernau
force-pushed
the
initial-black-duck-advisor
branch
from
20e80da to
6858178
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add an initial version of the integration of BlackDuck as security vulnerability provider.
Note: The implementation will be iterated upon, e.g. a curation mechanism to manually specify an origin will
be added in a following PR.
Part of: #8739.