Skip to content

Commit 994c2b6

Browse files
another-rexanother-rex
authored
feat: Update scalibr and add support for bun.lock (#1569)
Also reorder all the extractors so it's easier to read We actually had a duplicate extractor defined in there. This also fixes the issue with SBOM extraction discussed here: #1529 (comment) Though we still need to follow up with documentation updates.
1 parent 5b166c1 commit 994c2b6

File tree

6 files changed

+94
-6
lines changed

6 files changed

+94
-6
lines changed

‎cmd/osv-scanner/__snapshots__/main_test.snap

+45-2
Original file line numberDiff line numberDiff line change
@@ -339,16 +339,19 @@ Scanned <rootdir>/fixtures/locks-many/composer.lock file and found 1 package
339339
Scanned <rootdir>/fixtures/locks-many/package-lock.json file and found 1 package
340340
Scanned <rootdir>/fixtures/locks-many/yarn.lock file and found 1 package
341341
Scanning dir ./fixtures/locks-insecure
342+
Scanned <rootdir>/fixtures/locks-insecure/bun.lock file and found 2 packages
342343
Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
343344
Scanning dir ./fixtures/maven-transitive
344345
Scanned <rootdir>/fixtures/maven-transitive/pom.xml file and found 3 packages
345346
Filtered 1 local/unscannable package/s from the scan.
346347
Package npm/ansi-html/0.0.1 has been filtered out because: (no reason given)
347348
Package npm/balanced-match/1.0.2 has been filtered out because: (no reason given)
349+
Package npm/has-flag/4.0.0 has been filtered out because: (no reason given)
350+
Package npm/wrappy/1.0.2 has been filtered out because: (no reason given)
348351
Package Maven/org.apache.logging.log4j:log4j-api/2.14.1 has been filtered out because: it makes the table output really really long
349352
Package Maven/org.apache.logging.log4j:log4j-core/2.14.1 has been filtered out because: it makes the table output really really long
350353
Package Maven/org.apache.logging.log4j:log4j-web/2.14.1 has been filtered out because: it makes the table output really really long
351-
Filtered 5 ignored package/s from the scan.
354+
Filtered 7 ignored package/s from the scan.
352355
overriding license for package Alpine/alpine-baselayout/3.4.0-r0 with MIT
353356
overriding license for package Alpine/alpine-baselayout-data/3.4.0-r0 with MIT
354357
overriding license for package Alpine/alpine-keys/2.4-r1 with MIT
@@ -453,6 +456,22 @@ No issues found
453456
"version": "1.0.8",
454457
"licenses": [],
455458
"purl": "pkg:composer/league/[email protected]"
459+
},
460+
{
461+
"bom-ref": "pkg:npm/[email protected]",
462+
"type": "library",
463+
"name": "has-flag",
464+
"version": "4.0.0",
465+
"licenses": [],
466+
"purl": "pkg:npm/[email protected]"
467+
},
468+
{
469+
"bom-ref": "pkg:npm/[email protected]",
470+
"type": "library",
471+
"name": "wrappy",
472+
"version": "1.0.2",
473+
"licenses": [],
474+
"purl": "pkg:npm/[email protected]"
456475
}
457476
],
458477
"vulnerabilities": [
@@ -498,6 +517,7 @@ No issues found
498517

499518
[TestRun/cyclonedx_1.4_output - 2]
500519
Scanning dir ./fixtures/locks-insecure
520+
Scanned <rootdir>/fixtures/locks-insecure/bun.lock file and found 2 packages
501521
Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
502522

503523
---
@@ -516,6 +536,22 @@ Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
516536
"version": "1.0.8",
517537
"licenses": [],
518538
"purl": "pkg:composer/league/[email protected]"
539+
},
540+
{
541+
"bom-ref": "pkg:npm/[email protected]",
542+
"type": "library",
543+
"name": "has-flag",
544+
"version": "4.0.0",
545+
"licenses": [],
546+
"purl": "pkg:npm/[email protected]"
547+
},
548+
{
549+
"bom-ref": "pkg:npm/[email protected]",
550+
"type": "library",
551+
"name": "wrappy",
552+
"version": "1.0.2",
553+
"licenses": [],
554+
"purl": "pkg:npm/[email protected]"
519555
}
520556
],
521557
"vulnerabilities": [
@@ -561,6 +597,7 @@ Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
561597

562598
[TestRun/cyclonedx_1.5_output - 2]
563599
Scanning dir ./fixtures/locks-insecure
600+
Scanned <rootdir>/fixtures/locks-insecure/bun.lock file and found 2 packages
564601
Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
565602

566603
---
@@ -1631,11 +1668,14 @@ Scanned <rootdir>/fixtures/locks-many/composer.lock file and found 1 package
16311668
Scanned <rootdir>/fixtures/locks-many/package-lock.json file and found 1 package
16321669
Scanned <rootdir>/fixtures/locks-many/yarn.lock file and found 1 package
16331670
Scanning dir ./fixtures/locks-insecure
1671+
Scanned <rootdir>/fixtures/locks-insecure/bun.lock file and found 2 packages
16341672
Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
16351673
Filtered 1 local/unscannable package/s from the scan.
16361674
Package npm/ansi-html/0.0.1 has been filtered out because: (no reason given)
16371675
Package npm/balanced-match/1.0.2 has been filtered out because: (no reason given)
1638-
Filtered 2 ignored package/s from the scan.
1676+
Package npm/has-flag/4.0.0 has been filtered out because: (no reason given)
1677+
Package npm/wrappy/1.0.2 has been filtered out because: (no reason given)
1678+
Filtered 4 ignored package/s from the scan.
16391679
ignoring license for package Alpine/alpine-baselayout/3.4.0-r0
16401680
ignoring license for package Alpine/alpine-baselayout-data/3.4.0-r0
16411681
ignoring license for package Alpine/alpine-keys/2.4-r1
@@ -2747,6 +2787,7 @@ stat <rootdir>/path/to/my:project/package-lock.json: no such file or directory
27472787
Scanned <rootdir>/fixtures/locks-insecure/my-package-lock.json file as a package-lock.json and found 1 package
27482788
Scanned <rootdir>/fixtures/locks-insecure/my-yarn.lock file as a yarn.lock and found 1 package
27492789
Scanning dir ./fixtures/locks-insecure
2790+
Scanned <rootdir>/fixtures/locks-insecure/bun.lock file and found 2 packages
27502791
Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
27512792
+-------------------------------------+------+-----------+------------------+---------+----------------------------------------------+
27522793
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
@@ -2766,6 +2807,7 @@ Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
27662807
Scanned <rootdir>/fixtures/locks-insecure/my-yarn.lock file as a yarn.lock and found 1 package
27672808
Scanned <rootdir>/fixtures/locks-insecure/my-package-lock.json file as a package-lock.json and found 1 package
27682809
Scanning dir ./fixtures/locks-insecure
2810+
Scanned <rootdir>/fixtures/locks-insecure/bun.lock file and found 2 packages
27692811
Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
27702812
+-------------------------------------+------+-----------+------------------+---------+----------------------------------------------+
27712813
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
@@ -2813,6 +2855,7 @@ could not determine extractor, requested my-file
28132855
[TestRun_LockfileWithExplicitParseAs/when_an_explicit_parse-as_is_given,_it's_applied_to_that_file - 1]
28142856
Scanned <rootdir>/fixtures/locks-insecure/my-package-lock.json file as a package-lock.json and found 1 package
28152857
Scanning dir ./fixtures/locks-insecure
2858+
Scanned <rootdir>/fixtures/locks-insecure/bun.lock file and found 2 packages
28162859
Scanned <rootdir>/fixtures/locks-insecure/composer.lock file and found 1 package
28172860
+-------------------------------------+------+-----------+------------------+---------+----------------------------------------------+
28182861
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | SOURCE |

‎cmd/osv-scanner/fixtures/locks-insecure/bun.lock

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"lockfileVersion": 0,
3+
"workspaces": {
4+
"": {
5+
"name": "bun-lockfile",
6+
"dependencies": {
7+
"has-flag": "*",
8+
"wrappy": "^1.0.0",
9+
},
10+
},
11+
},
12+
"packages": {
13+
"has-flag": ["[email protected]", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
14+
15+
"wrappy": ["[email protected]", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
16+
}
17+
}

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ require (
1717
github.com/go-git/go-billy/v5 v5.6.2
1818
github.com/go-git/go-git/v5 v5.13.2
1919
github.com/google/go-cmp v0.6.0
20-
github.com/google/osv-scalibr v0.1.6-0.20250204042239-1e0c0f48841d
20+
github.com/google/osv-scalibr v0.1.7-0.20250205161050-34e66e88be2f
2121
github.com/ianlancetaylor/demangle v0.0.0-20240912202439-0a2b6291aafd
2222
github.com/jedib0t/go-pretty/v6 v6.6.5
2323
github.com/muesli/reflow v0.3.0

‎go.sum

+2
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,8 @@ github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l
184184
github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
185185
github.com/google/osv-scalibr v0.1.6-0.20250204042239-1e0c0f48841d h1:QoncpqAA6ehwjH6Zu9OV/TouftSIPChGH7cOPorzjWQ=
186186
github.com/google/osv-scalibr v0.1.6-0.20250204042239-1e0c0f48841d/go.mod h1:G4uAYcj3eBCWG0k7q8z5n9B4zcjT5iAZqQj2DbSeIoY=
187+
github.com/google/osv-scalibr v0.1.7-0.20250205161050-34e66e88be2f h1:wbB8jN6eUdQXS89gykLjjsybNG4KAAB9dCoUN6xlNPQ=
188+
github.com/google/osv-scalibr v0.1.7-0.20250205161050-34e66e88be2f/go.mod h1:QIEHZfY/muD9/oouPNaUQKpeZKr87pKOTNpXQxpVnoE=
187189
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
188190
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
189191
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

‎pkg/osvscanner/internal/scanners/extractorbuilder.go

+28-3
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"github.com/google/osv-scalibr/extractor/filesystem/language/cpp/conanlock"
66
"github.com/google/osv-scalibr/extractor/filesystem/language/dart/pubspec"
77
"github.com/google/osv-scalibr/extractor/filesystem/language/dotnet/depsjson"
8-
"github.com/google/osv-scalibr/extractor/filesystem/language/dotnet/packageslockjson"
98
"github.com/google/osv-scalibr/extractor/filesystem/language/erlang/mixlock"
109
"github.com/google/osv-scalibr/extractor/filesystem/language/golang/gobinary"
1110
"github.com/google/osv-scalibr/extractor/filesystem/language/golang/gomod"
@@ -15,6 +14,7 @@ import (
1514
"github.com/google/osv-scalibr/extractor/filesystem/language/java/gradlelockfile"
1615
"github.com/google/osv-scalibr/extractor/filesystem/language/java/gradleverificationmetadataxml"
1716
"github.com/google/osv-scalibr/extractor/filesystem/language/java/pomxml"
17+
"github.com/google/osv-scalibr/extractor/filesystem/language/javascript/bunlock"
1818
"github.com/google/osv-scalibr/extractor/filesystem/language/javascript/packagelockjson"
1919
"github.com/google/osv-scalibr/extractor/filesystem/language/javascript/pnpmlock"
2020
"github.com/google/osv-scalibr/extractor/filesystem/language/javascript/yarnlock"
@@ -48,26 +48,51 @@ var sbomExtractors = []filesystem.Extractor{
4848
}
4949

5050
var lockfileExtractors = []filesystem.Extractor{
51+
// C
5152
conanlock.Extractor{},
52-
packageslockjson.Extractor{},
53+
54+
// Erlang
5355
mixlock.Extractor{},
56+
57+
// Flutter
5458
pubspec.Extractor{},
59+
60+
// Go
5561
gomod.Extractor{},
62+
63+
// Java
5664
gradlelockfile.Extractor{},
5765
gradleverificationmetadataxml.Extractor{},
66+
67+
// Javascript
5868
packagelockjson.Extractor{},
5969
pnpmlock.Extractor{},
6070
yarnlock.Extractor{},
71+
bunlock.Extractor{},
72+
73+
// PHP
6174
composerlock.Extractor{},
75+
76+
// Python
6277
pipfilelock.Extractor{},
6378
pdmlock.Extractor{},
6479
poetrylock.Extractor{},
6580
requirements.Extractor{},
81+
uvlock.Extractor{},
82+
83+
// R
6684
renvlock.Extractor{},
85+
86+
// Ruby
6787
gemfilelock.Extractor{},
88+
89+
// Rust
6890
cargolock.Extractor{},
69-
uvlock.Extractor{},
91+
92+
// NuGet
7093
depsjson.Extractor{},
94+
95+
// Haskell
7196
cabal.Extractor{},
7297
stacklock.Extractor{},
7398
// TODO: map the extracted packages to SwiftURL in OSV.dev

‎pkg/osvscanner/internal/scanners/lockfile.go

+1
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ var lockfileExtractorMapping = map[string]string{
4040
"packages.lock.json": "dotnet/packageslockjson",
4141
"conan.lock": "cpp/conanlock",
4242
"go.mod": "go/gomod",
43+
"bun.lock": "javascript/bunlock",
4344
"Gemfile.lock": "ruby/gemfilelock",
4445
"cabal.project.freeze": "haskell/cabal",
4546
"stack.yaml.lock": "haskell/stacklock",

0 commit comments

Comments
 (0)