uv-sbom 2.3.0

SBOM generation tool for uv projects - Generate CycloneDX SBOMs from uv.lock files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

use super::super::schema::{Affect, Rating, Vulnerability, VulnerabilitySource};
use super::property;
use crate::application::read_models::{
    ResolutionGuideView, UpgradeRecommendationView, VulnerabilityReportView, VulnerabilityView,
};

/// Build a list of CycloneDX [`Vulnerability`] entries from a [`VulnerabilityReportView`].
///
/// Actionable vulnerabilities are listed first, followed by informational ones.
pub(in super::super) fn build_all(
    report: &VulnerabilityReportView,
    resolution_guide: Option<&ResolutionGuideView>,
    upgrade_recommendations: Option<&UpgradeRecommendationView>,
) -> Vec<Vulnerability> {
    let mut vulnerabilities = Vec::new();

    for vuln in &report.actionable {
        vulnerabilities.push(build(vuln, resolution_guide, upgrade_recommendations));
    }

    for vuln in &report.informational {
        vulnerabilities.push(build(vuln, resolution_guide, upgrade_recommendations));
    }

    vulnerabilities
}

/// Build a single CycloneDX [`Vulnerability`] entry from a [`VulnerabilityView`].
fn build(
    vuln: &VulnerabilityView,
    resolution_guide: Option<&ResolutionGuideView>,
    upgrade_recommendations: Option<&UpgradeRecommendationView>,
) -> Vulnerability {
    let source = vuln
        .source_url
        .as_ref()
        .map(|url| VulnerabilitySource { url: url.clone() });

    let ratings = Some(vec![Rating {
        score: vuln.cvss_score,
        severity: vuln.severity.as_str().to_string(),
        vector: vuln.cvss_vector.clone(),
    }]);

    let properties =
        property::from_resolution_guide(vuln, resolution_guide, upgrade_recommendations);

    Vulnerability {
        bom_ref: vuln.bom_ref.clone(),
        id: vuln.id.clone(),
        description: vuln.description.clone(),
        source,
        ratings,
        affects: vec![Affect {
            bom_ref: vuln.affected_component.clone(),
        }],
        properties,
    }
}