erlef / mix_sbom / 37905107720

70%

Build Type

push

github

Committed by web-flow

Commit Message

Add vulnerabilities from OSV.dev (#160)

* Add vulnerabilities from OSV.dev

Each SCM returns an OSV.dev query for its dependencies (new optional
`osv_query/2` callback):

- Hex: package name and locked version (hex.pm only)
- Git: locked commit
- System: Elixir and OTP as GIT packages; the full OTP version is read
  from OTP_VERSION. Skipped inside Burrito, where system app versions
  are not read.

Identical queries are deduplicated and sent with `querybatch` in
batches of 1000 using `:httpc`. If OSV.dev is unreachable a warning
is logged and the SBoM is generated without vulnerabilities.

Vulnerabilities are attached for schema 1.4+ with the OSV id, a link
to osv.dev and the affected components. XML decoding was extended as
well, so an unchanged XML SBoM is still rewritten when new
vulnerabilities appear. Enabled by default; disable with
`--no-vulnerabilities`, the `vulnerabilities` action input or
`vulnerabilities: false`.

Tests that don't cover this feature disable it, following #147.

Known limitations:
- `querybatch` only returns ids, so no description or severity.
- An OTP vulnerability is reported for every OTP component, since
  OSV.dev matches the OTP release as a whole.

Closes #155

* Fetch vulnerability details and cover them in the property test

querybatch only returns ids, so the details of every found vulnerability
are fetched once per id and in parallel from /v1/vulns/{id}. A
vulnerability whose details can't be fetched keeps its id and logs a
warning.

The OSV record is mapped to description (summary), detail (details),
references (aliases), advisories (ADVISORY references), published and
updated (modified).

The "generates valid SBOM files in each format" property test now
also generates vulnerabilities.

* Query OSV with full git tag names for Elixir and OTP

Coverage Stats

83 of 103 new or added lines in 9 files covered. (80.58%)

1 existing line in 1 file now uncovered.

954 of 1370 relevant lines covered (69.64%)

2338.17 hits per line