epugh commented on code in PR #204:
URL: https://github.com/apache/solr-site/pull/204#discussion_r3611349482
##########
plugins/vex/vex.py:
##########
@@ -156,6 +159,299 @@ def pelican_init(pelicanobj):
with open('%s/solr.vex.json' % output_path, 'w') as out:
json.dump(vex, out, indent=2)
+ # OpenVEX (https://openvex.dev/) output, derived from the same entries and
+ # validated against the vendored OpenVEX JSON schema.
+ openvex = build_openvex(vex_input)
+ with open(SCHEMA_DIR / 'openvex_json_schema.json') as schema:
+ validate(openvex, json.load(schema))
+ with open('%s/solr.openvex.json' % output_path, 'w') as out:
+ json.dump(openvex, out, indent=2)
+
+
+# --- OpenVEX generation -----------------------------------------------------
+
+# CycloneDX analysis.state -> OpenVEX status vocabulary.
+OPENVEX_STATUS = {
+ 'not_affected': 'not_affected',
+ 'exploitable': 'affected',
+ 'in_triage': 'under_investigation',
+ 'resolved': 'fixed',
+}
+
+# CycloneDX analysis.justification -> OpenVEX justification, for the cases that
+# have a clean equivalent. 'requires_configuration' has no OpenVEX counterpart,
+# so those not_affected statements rely on impact_statement instead.
+OPENVEX_JUSTIFICATION = {
+ 'code_not_present': 'vulnerable_code_not_present',
+ 'code_not_reachable': 'vulnerable_code_not_in_execute_path',
+}
+
+# Maven groupIds for the artifacts our VEX entries reference, so a JAR name can
+# be emitted as a proper purl subcomponent. Artifacts not listed here (or JARs
+# whose version can't be parsed, e.g. "guava-*.jar") fall back to a bare @id.
+JAR_GROUPS = {
Review Comment:
Totally! I'm currently looking for better ways then this hard coded stuff,
which obviously is totally brittle. One thing I am struggling with is that
this "runtime" file generates the vex stuff, and isn't part of the main `solr`
site's gradle build etc. I've never really look into the META-INF stuff... I
will.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
