bitvex 0.2.5

Automate CRA compliance: generate OpenVEX reports from Yocto SBOMs by filtering CVEs with kernel config and device tree analysis
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

use tabled::{Table, Tabled};

use crate::vex::{VexStatement, VexStatus};

#[derive(Tabled)]
struct VulnRow {
    #[tabled(rename = "CVE")]
    cve: String,
    #[tabled(rename = "Package (purl)")]
    purl: String,
    #[tabled(rename = "Status")]
    status: String,
    #[tabled(rename = "Justification")]
    justification: String,
}

pub fn print_summary(
    total_packages: usize,
    native_filtered: usize,
    kernel_filtered: usize,
    dts_filtered: usize,
    statements: &[VexStatement],
) {
    let real_cve_count = statements
        .iter()
        .filter(|s| s.status == VexStatus::Affected || s.status == VexStatus::UnderInvestigation)
        .count();

    let not_affected_count = statements
        .iter()
        .filter(|s| s.status == VexStatus::NotAffected)
        .count();

    let fixed_count = statements
        .iter()
        .filter(|s| s.status == VexStatus::Fixed)
        .count();

    println!();
    println!("╔══════════════════════════════════════════════════════╗");
    println!("║          BitVex - CRA Compliance Report             ║");
    println!("╠══════════════════════════════════════════════════════╣");
    println!(
        "║  Total packages analyzed:     {:<5}                  ║",
        total_packages
    );
    println!(
        "║  Native packages filtered:    {:<5}                  ║",
        native_filtered
    );
    println!(
        "║  Kernel drivers filtered:     {:<5}                  ║",
        kernel_filtered
    );
    println!(
        "║  DTS disabled filtered:       {:<5}                  ║",
        dts_filtered
    );
    println!("║  ─────────────────────────────────────              ║");
    println!(
        "║  CVEs marked not_affected:    {:<5}                  ║",
        not_affected_count
    );
    println!(
        "║  CVEs marked fixed:           {:<5}                  ║",
        fixed_count
    );
    println!(
        "║  Real CVEs to address:        {:<5}                  ║",
        real_cve_count
    );
    println!("╚══════════════════════════════════════════════════════╝");

    let affected: Vec<&VexStatement> = statements
        .iter()
        .filter(|s| s.status != VexStatus::NotAffected)
        .collect();

    if !affected.is_empty() {
        println!();
        println!("Vulnerabilities requiring attention:");
        println!();

        let rows: Vec<VulnRow> = affected
            .iter()
            .map(|s| VulnRow {
                cve: s.vulnerability_name.clone(),
                purl: truncate_str(&s.product_purl, 40),
                status: s.status.as_str().to_string(),
                justification: s
                    .justification
                    .clone()
                    .or_else(|| s.impact_statement.clone())
                    .unwrap_or_default(),
            })
            .collect();

        let table = Table::new(rows).to_string();
        println!("{}", table);
    }

    println!();
}

fn truncate_str(s: &str, max_len: usize) -> String {
    if s.len() <= max_len {
        s.to_string()
    } else {
        format!("{}…", &s[..max_len - 1])
    }
}