Conversation
91d0890 to
94a72ef
Compare
| CycloneDXFormat Format = "cyclonedx" | ||
| CycloneDXJSON Format = "cyclonedx-json" | ||
| CycloneDXXML Format = "cyclonedx-xml" | ||
| CycloneDXFormatv1_5 Format = "cyclonedx-v1.5" |
There was a problem hiding this comment.
I don't think we should use this format exactly. We have handling in Syft for formats in different versions with the syntax: <format>@<version>, for CycloneDX, it would be cyclonedx-json@1.5. There is some logic to handle versions nicely including finding the latest version where only a major version is specified, for example spdx-json@2 results in spdx-json version 2.3. It would be nice to reuse this logic, but it looks like it's somewhat specific to an sbom.FormatEncoder. In the meantime, we should use an identical syntax in Grype, e.g.: cyclonedx@1.5, cyclonedx-json@1.5, and cyclonedx-xml@1.5
There was a problem hiding this comment.
I wasn't aware of there being a specific format to the versioning. Would it be good to change Format into a struct and use some of the logic from FormatEncoder?
There was a problem hiding this comment.
We want to update the Grype presenters to be more like Syft formats, but I wouldn't ask you to do this as part of your PR here unless you felt like it. The main thing is the version strings specified should be the same between the tools
There was a problem hiding this comment.
Yep, that makes total sense to me. I'm not fully familiar with Go so I'll probably just update the formatting stuff to handle the version.
There was a problem hiding this comment.
Ok, I've gotten it to use the Syft formatted version string. Not the prettiest implementation but it's straightforward and it works.
52fb622 to
8f9440f
Compare
|
Apologies for not running the tests earlier -- it looks like there are some static analysis failures -- these seem straightforward: unnecessary conversion and |
Signed-off-by: Tristan Ross <tristan.ross@determinate.systems>
8f9440f to
9116f39
Compare
|
Great, I believe those should be fixed now. I tried running |
It is useful to be able to write CycloneDX v1.5 VEX since the CycloneDX Rust crate does not support v1.6 yet (ref: CycloneDX/cyclonedx-rust-cargo#769). Rather than waiting for the crate to support that, or spending the time to implement it, it is simpler to just make Grype support it.