Skip to content

Commit 0fa489f

Browse files
committed
add report and score for fsct
Signed-off-by: Vivek Kumar Sahu <[email protected]>
1 parent 55b3125 commit 0fa489f

File tree

10 files changed

+736
-179
lines changed

10 files changed

+736
-179
lines changed

cmd/compliance.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ var complianceCmd = &cobra.Command{
4141
4242
# Check a OpenChain Telco compliance against a SBOM in a JSON output
4343
sbomqs compliance --oct --json samples/sbomqs-spdx-syft.json
44+
45+
# Check a V3 Framing document compliance against a SBOM in a table output
46+
sbomqs compliance --fsct-v3 <sbom>
47+
48+
# Check a V3 Framing document compliance against a SBOM in a JSON output
49+
sbomqs compliance --fsct-v3 -j <sbom>
4450
`,
4551
Args: func(cmd *cobra.Command, args []string) error {
4652
if err := cobra.ExactArgs(1)(cmd, args); err != nil {
@@ -74,6 +80,7 @@ func setupEngineParams(cmd *cobra.Command, args []string) *engine.Params {
7480
// engParams.Ntia, _ = cmd.Flags().GetBool("ntia")
7581
engParams.Bsi, _ = cmd.Flags().GetBool("bsi")
7682
engParams.Oct, _ = cmd.Flags().GetBool("oct")
83+
engParams.Fsct, _ = cmd.Flags().GetBool("fsct")
7784

7885
engParams.Debug, _ = cmd.Flags().GetBool("debug")
7986

@@ -100,4 +107,5 @@ func init() {
100107
complianceCmd.Flags().BoolP("bsi", "c", false, "BSI TR-03183-2 v1.1 compliance")
101108
// complianceCmd.MarkFlagsMutuallyExclusive("ntia", "cra")
102109
complianceCmd.Flags().BoolP("oct", "t", false, "OpenChainTelco compliance")
110+
complianceCmd.Flags().BoolP("fsct-v3", "fv", false, "V3 Framing document compliance")
103111
}

pkg/compliance/common/common.go

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
// Copyright 2024 Interlynk.io
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// https://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package common
16+
17+
import (
18+
"time"
19+
20+
"github.com/interlynk-io/sbomqs/pkg/cpe"
21+
"github.com/interlynk-io/sbomqs/pkg/omniborid"
22+
"github.com/interlynk-io/sbomqs/pkg/purl"
23+
"github.com/interlynk-io/sbomqs/pkg/sbom"
24+
"github.com/interlynk-io/sbomqs/pkg/swhid"
25+
"github.com/interlynk-io/sbomqs/pkg/swid"
26+
"github.com/samber/lo"
27+
)
28+
29+
func CheckTools(tools []sbom.GetTool) (string, bool) {
30+
for _, tool := range tools {
31+
if name := tool.GetName(); name != "" {
32+
return name, true
33+
}
34+
}
35+
return "", false
36+
}
37+
38+
func CheckAuthors(authors []sbom.Author) (string, bool) {
39+
for _, author := range authors {
40+
if email := author.Email(); email != "" {
41+
return email, true
42+
}
43+
}
44+
return "", false
45+
}
46+
47+
func CheckSupplier(supplier sbom.GetSupplier) (string, bool) {
48+
if email := supplier.GetEmail(); email != "" {
49+
return email, true
50+
}
51+
52+
if url := supplier.GetURL(); url != "" {
53+
return url, true
54+
}
55+
56+
if contacts := supplier.GetContacts(); contacts != nil {
57+
for _, contact := range contacts {
58+
if email := contact.Email(); email != "" {
59+
return email, true
60+
}
61+
}
62+
}
63+
return "", false
64+
}
65+
66+
func CheckManufacturer(manufacturer sbom.Manufacturer) (string, bool) {
67+
if email := manufacturer.GetEmail(); email != "" {
68+
return email, true
69+
}
70+
71+
if url := manufacturer.GetURL(); url != "" {
72+
return url, true
73+
}
74+
75+
if contacts := manufacturer.GetContacts(); contacts != nil {
76+
for _, contact := range contacts {
77+
if email := contact.Email(); email != "" {
78+
return email, true
79+
}
80+
}
81+
}
82+
return "", false
83+
}
84+
85+
func CheckTimestamp(timestamp string) (string, bool) {
86+
_, err := time.Parse(time.RFC3339, timestamp)
87+
if err != nil {
88+
return timestamp, false
89+
}
90+
return timestamp, true
91+
}
92+
93+
func CheckPurls(purl []purl.PURL) (string, bool) {
94+
if result := string(purl[0]); result != "" {
95+
return result, true
96+
}
97+
return "", false
98+
}
99+
100+
func CheckCpes(cpes []cpe.CPE) (string, bool) {
101+
if result := string(cpes[0]); result != "" {
102+
return result, true
103+
}
104+
return "", false
105+
}
106+
107+
func CheckOmnibor(omni []omniborid.OMNIBORID) (string, bool) {
108+
if result := string(omni[0]); result != "" {
109+
return result, true
110+
}
111+
return "", false
112+
}
113+
114+
func CheckSwhid(swhid []swhid.SWHID) (string, bool) {
115+
if result := string(swhid[0]); result != "" {
116+
return result, true
117+
}
118+
return "", false
119+
}
120+
121+
func CheckSwid(swid []swid.SWID) (string, bool) {
122+
if swid[0].GetTagID() != "" && swid[0].GetName() != "" {
123+
result := string(swid[0].GetTagID()) + ", " + string(swid[0].GetName())
124+
return result, true
125+
}
126+
return "", false
127+
}
128+
129+
func CheckHash(checksums []sbom.GetChecksum) (string, bool) {
130+
algos := []string{"SHA256", "SHA-256", "sha256", "sha-256", "SHA1", "SHA-1", "sha1", "sha-1", "MD5", "md5"}
131+
for _, checksum := range checksums {
132+
algo := checksum.GetAlgo()
133+
if lo.Contains(algos, algo) {
134+
if content := checksum.GetContent(); content != "" {
135+
return content, true
136+
}
137+
}
138+
}
139+
return "", false
140+
}
141+
142+
func CheckHigherHash(checksums []sbom.GetChecksum) (string, bool) {
143+
recommendedAlgos := []string{"SHA-512"}
144+
for _, checksum := range checksums {
145+
algo := checksum.GetAlgo()
146+
if lo.Contains(recommendedAlgos, algo) {
147+
if content := checksum.GetContent(); content != "" {
148+
return content, true
149+
}
150+
}
151+
}
152+
return "", false
153+
}
154+
155+
func CheckCopyright(cp string) (string, bool) {
156+
return cp, cp != "NOASSERTION" && cp != "NONE"
157+
}

pkg/compliance/compliance.go

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
"errors"
2020
"fmt"
2121

22+
"github.com/interlynk-io/sbomqs/pkg/compliance/fsct"
2223
"github.com/interlynk-io/sbomqs/pkg/logger"
2324
"github.com/interlynk-io/sbomqs/pkg/sbom"
2425
)
@@ -28,6 +29,7 @@ const (
2829
BSI_REPORT = "BSI"
2930
NTIA_REPORT = "NTIA"
3031
OCT_TELCO = "OCT"
32+
FSCT_V3 = "FSCT"
3133
)
3234

3335
//nolint:revive,stylecheck
@@ -55,20 +57,26 @@ func ComplianceResult(ctx context.Context, doc sbom.Document, reportType, fileNa
5557
return errors.New("output format is empty")
5658
}
5759

58-
if reportType == BSI_REPORT {
60+
switch {
61+
case reportType == BSI_REPORT:
5962
bsiResult(ctx, doc, fileName, outFormat)
60-
}
6163

62-
if reportType == NTIA_REPORT {
64+
case reportType == NTIA_REPORT:
6365
ntiaResult(ctx, doc, fileName, outFormat)
64-
}
6566

66-
if reportType == OCT_TELCO {
67+
case reportType == OCT_TELCO:
6768
if doc.Spec().GetSpecType() != "spdx" {
6869
fmt.Println("The Provided SBOM spec is other than SPDX. Open Chain Telco only support SPDX specs SBOMs.")
6970
return nil
7071
}
7172
octResult(ctx, doc, fileName, outFormat)
73+
74+
case reportType == FSCT_V3:
75+
fsct.FsctResult(ctx, doc, fileName, outFormat)
76+
77+
default:
78+
fmt.Println("No compliance type is provided")
79+
7280
}
7381

7482
return nil

pkg/compliance/db/db.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
// Copyright 2023 Interlynk.io
1+
// Copyright 2024 Interlynk.io
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
55
// You may obtain a copy of the License at
66
//
7-
// http://www.apache.org/licenses/LICENSE-2.0
7+
// https://www.apache.org/licenses/LICENSE-2.0
88
//
99
// Unless required by applicable law or agreed to in writing, software
1010
// distributed under the License is distributed on an "AS IS" BASIS,

pkg/compliance/db/db_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
// Copyright 2023 Interlynk.io
1+
// Copyright 2024 Interlynk.io
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
55
// You may obtain a copy of the License at
66
//
7-
// http://www.apache.org/licenses/LICENSE-2.0
7+
// https://www.apache.org/licenses/LICENSE-2.0
88
//
99
// Unless required by applicable law or agreed to in writing, software
1010
// distributed under the License is distributed on an "AS IS" BASIS,

0 commit comments

Comments
 (0)