diff --git a/sbom/report_collection.go b/sbom/report_collection.go index 7c872d9823..818c325dba 100644 --- a/sbom/report_collection.go +++ b/sbom/report_collection.go @@ -41,6 +41,9 @@ type BomAsset struct { type BomPackage struct { Name string `json:"name,omitempty"` Version string `json:"version,omitempty"` + Origin string `json:"origin,omitempty"` + Arch string `json:"arch,omitempty"` + Format string `json:"format,omitempty"` Purl string `json:"purl,omitempty"` CPEs []string `json:"cpes.map,omitempty"` // used by python packages @@ -48,7 +51,6 @@ type BomPackage struct { FilePath string `json:"file.path,omitempty"` // used by os packages FilePaths []string `json:"files.map,omitempty"` - Format string `json:"format,omitempty"` } type BomReport struct { diff --git a/sbom/sbom.go b/sbom/sbom.go index 7d9a91d5ad..8eaebdfb69 100644 --- a/sbom/sbom.go +++ b/sbom/sbom.go @@ -90,11 +90,13 @@ func GenerateBom(r *ReportCollectionJson) ([]Sbom, error) { if rb.Packages != nil { for _, pkg := range rb.Packages { bomPkg := &Package{ - Name: pkg.Name, - Version: pkg.Version, - Purl: pkg.Purl, - Cpes: pkg.CPEs, - Type: pkg.Format, + Name: pkg.Name, + Version: pkg.Version, + Architecture: pkg.Arch, + Origin: pkg.Origin, + Purl: pkg.Purl, + Cpes: pkg.CPEs, + Type: pkg.Format, } for _, filepath := range pkg.FilePaths { diff --git a/sbom/sbom.mql.yaml b/sbom/sbom.mql.yaml index d83891d41f..759cd60553 100644 --- a/sbom/sbom.mql.yaml +++ b/sbom/sbom.mql.yaml @@ -12,7 +12,7 @@ packs: mql: asset { name platform version arch ids labels cpes.map(uri) } - uid: mondoo-sbom-packages title: Retrieve list of installed packages - mql: packages { name version purl cpes.map(uri) format files.map(path) } + mql: packages { name version purl cpes.map(uri) arch origin format files.map(path) } - uid: mondoo-sbom-python-packages title: Retrieve list of installed Python packages mql: python.packages { name version purl cpes.map(uri) file.path } diff --git a/sbom/sbom.pb.go b/sbom/sbom.pb.go index d98ce4f675..47deca77c1 100644 --- a/sbom/sbom.pb.go +++ b/sbom/sbom.pb.go @@ -712,6 +712,8 @@ type Package struct { // 'evidence_list' is a collection of evidence that supports the presence of // the package in the asset. This evidence could include eg. file paths EvidenceList []*Evidence `protobuf:"bytes,21,rep,name=evidence_list,json=evidenceList,proto3" json:"evidence_list,omitempty"` + // Package Origin (e.g. other package name, or source of the package) + Origin string `protobuf:"bytes,22,opt,name=origin,proto3" json:"origin,omitempty"` } func (x *Package) Reset() { @@ -809,6 +811,13 @@ func (x *Package) GetEvidenceList() []*Evidence { return nil } +func (x *Package) GetOrigin() string { + if x != nil { + return x.Origin + } + return "" +} + type Evidence struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache @@ -938,7 +947,7 @@ var file_sbom_proto_rawDesc = []byte{ 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, - 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x94, 0x02, 0x0a, 0x07, 0x50, 0x61, 0x63, 0x6b, 0x61, + 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xac, 0x02, 0x0a, 0x07, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, @@ -955,36 +964,38 @@ var file_sbom_proto_rawDesc = []byte{ 0x0a, 0x0d, 0x65, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x15, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x6f, 0x6e, 0x64, 0x6f, 0x6f, 0x2e, 0x73, 0x62, 0x6f, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x52, - 0x0c, 0x65, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x22, 0x52, 0x0a, - 0x08, 0x45, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x30, 0x0a, 0x04, 0x74, 0x79, 0x70, - 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1c, 0x2e, 0x6d, 0x6f, 0x6e, 0x64, 0x6f, 0x6f, - 0x2e, 0x73, 0x62, 0x6f, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, - 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, - 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, - 0x65, 0x2a, 0x7d, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x16, 0x0a, 0x12, 0x53, - 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, - 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, 0x55, - 0x43, 0x43, 0x45, 0x45, 0x44, 0x45, 0x44, 0x10, 0x01, 0x12, 0x1e, 0x0a, 0x1a, 0x53, 0x54, 0x41, - 0x54, 0x55, 0x53, 0x5f, 0x50, 0x41, 0x52, 0x54, 0x49, 0x41, 0x4c, 0x4c, 0x59, 0x5f, 0x53, 0x55, - 0x43, 0x43, 0x45, 0x45, 0x44, 0x45, 0x44, 0x10, 0x02, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, - 0x54, 0x55, 0x53, 0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44, 0x10, 0x03, 0x12, 0x12, 0x0a, 0x0e, - 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54, 0x45, 0x44, 0x10, 0x04, - 0x2a, 0x90, 0x01, 0x0a, 0x0e, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x49, 0x44, 0x54, - 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x1c, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x5f, - 0x49, 0x44, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, - 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x20, 0x0a, 0x1c, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, - 0x4c, 0x5f, 0x49, 0x44, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x57, 0x53, 0x5f, 0x41, 0x43, - 0x43, 0x4f, 0x55, 0x4e, 0x54, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x45, 0x58, 0x54, 0x45, 0x52, - 0x4e, 0x41, 0x4c, 0x5f, 0x49, 0x44, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x57, 0x53, 0x5f, - 0x41, 0x52, 0x4e, 0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, - 0x4c, 0x5f, 0x49, 0x44, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x41, 0x57, 0x53, 0x5f, 0x4f, 0x52, - 0x47, 0x10, 0x03, 0x2a, 0x45, 0x0a, 0x0c, 0x45, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x54, - 0x79, 0x70, 0x65, 0x12, 0x1d, 0x0a, 0x19, 0x45, 0x56, 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, - 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, - 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x45, 0x56, 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x54, - 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x01, 0x42, 0x1c, 0x5a, 0x1a, 0x67, 0x6f, - 0x2e, 0x6d, 0x6f, 0x6e, 0x64, 0x6f, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6e, 0x71, 0x75, - 0x65, 0x72, 0x79, 0x2f, 0x73, 0x62, 0x6f, 0x6d, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x0c, 0x65, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x16, 0x0a, + 0x06, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x18, 0x16, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6f, + 0x72, 0x69, 0x67, 0x69, 0x6e, 0x22, 0x52, 0x0a, 0x08, 0x45, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, + 0x65, 0x12, 0x30, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, + 0x1c, 0x2e, 0x6d, 0x6f, 0x6e, 0x64, 0x6f, 0x6f, 0x2e, 0x73, 0x62, 0x6f, 0x6d, 0x2e, 0x76, 0x31, + 0x2e, 0x45, 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, + 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2a, 0x7d, 0x0a, 0x06, 0x53, 0x74, 0x61, + 0x74, 0x75, 0x73, 0x12, 0x16, 0x0a, 0x12, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, + 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x53, + 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, 0x55, 0x43, 0x43, 0x45, 0x45, 0x44, 0x45, 0x44, 0x10, + 0x01, 0x12, 0x1e, 0x0a, 0x1a, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x50, 0x41, 0x52, 0x54, + 0x49, 0x41, 0x4c, 0x4c, 0x59, 0x5f, 0x53, 0x55, 0x43, 0x43, 0x45, 0x45, 0x44, 0x45, 0x44, 0x10, + 0x02, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x46, 0x41, 0x49, 0x4c, + 0x45, 0x44, 0x10, 0x03, 0x12, 0x12, 0x0a, 0x0e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, + 0x54, 0x41, 0x52, 0x54, 0x45, 0x44, 0x10, 0x04, 0x2a, 0x90, 0x01, 0x0a, 0x0e, 0x45, 0x78, 0x74, + 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x49, 0x44, 0x54, 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x1c, 0x45, + 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x5f, 0x49, 0x44, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, + 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x20, 0x0a, + 0x1c, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x5f, 0x49, 0x44, 0x5f, 0x54, 0x59, 0x50, + 0x45, 0x5f, 0x41, 0x57, 0x53, 0x5f, 0x41, 0x43, 0x43, 0x4f, 0x55, 0x4e, 0x54, 0x10, 0x01, 0x12, + 0x1c, 0x0a, 0x18, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x5f, 0x49, 0x44, 0x5f, 0x54, + 0x59, 0x50, 0x45, 0x5f, 0x41, 0x57, 0x53, 0x5f, 0x41, 0x52, 0x4e, 0x10, 0x02, 0x12, 0x1c, 0x0a, + 0x18, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x5f, 0x49, 0x44, 0x5f, 0x54, 0x59, 0x50, + 0x45, 0x5f, 0x41, 0x57, 0x53, 0x5f, 0x4f, 0x52, 0x47, 0x10, 0x03, 0x2a, 0x45, 0x0a, 0x0c, 0x45, + 0x76, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1d, 0x0a, 0x19, 0x45, + 0x56, 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, + 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x45, 0x56, + 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x4c, 0x45, + 0x10, 0x01, 0x42, 0x1c, 0x5a, 0x1a, 0x67, 0x6f, 0x2e, 0x6d, 0x6f, 0x6e, 0x64, 0x6f, 0x6f, 0x2e, + 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6e, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2f, 0x73, 0x62, 0x6f, 0x6d, + 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( diff --git a/sbom/sbom.proto b/sbom/sbom.proto index e3e5c37ed6..c281068a03 100644 --- a/sbom/sbom.proto +++ b/sbom/sbom.proto @@ -216,6 +216,8 @@ message Package { // 'evidence_list' is a collection of evidence that supports the presence of // the package in the asset. This evidence could include eg. file paths repeated Evidence evidence_list = 21; + // Package Origin (e.g. other package name, or source of the package) + string origin = 22; } enum EvidenceType { diff --git a/sbom/textlist.go b/sbom/textlist.go index b2a45be947..d6817e33bd 100644 --- a/sbom/textlist.go +++ b/sbom/textlist.go @@ -61,6 +61,11 @@ func (s *TextList) Render(w io.Writer, bom *Sbom) error { sb.WriteString(" ") sb.WriteString(pkg.Architecture) } + if pkg.Origin != "" { + sb.WriteString(" (origin:") + sb.WriteString(pkg.Origin) + sb.WriteString(")") + } // we only print the location if it is not empty // this approach is deprecated and we should remove that once everything moved to evidence