From eec92a9735fd5a9ab345f1e870c71ccd9343a13f Mon Sep 17 00:00:00 2001 From: Henri Rosten Date: Wed, 6 Nov 2024 13:38:38 +0200 Subject: [PATCH] Re-enable vulnix scan for CDX vulns Signed-off-by: Henri Rosten --- src/sbomnix/sbomdb.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/sbomnix/sbomdb.py b/src/sbomnix/sbomdb.py index 54ff54a..2113cd2 100644 --- a/src/sbomnix/sbomdb.py +++ b/src/sbomnix/sbomdb.py @@ -215,6 +215,7 @@ def to_cdx(self, cdx_path, printinfo=True): df_vulns = None if self.include_vulns: scanner = VulnScan() + scanner.scan_vulnix(self.target_deriver, self.buildtime) # Write incomplete sbom to a temporary path, then perform a vulnerability scan with NamedTemporaryFile( delete=False, prefix="vulnxscan_", suffix=".json" @@ -225,7 +226,7 @@ def to_cdx(self, cdx_path, printinfo=True): cdx["vulnerabilities"] = [] # Union all scans into a single dataframe df_vulns = pd.concat( - [scanner.df_grype, scanner.df_osv], + [scanner.df_grype, scanner.df_osv, scanner.df_vulnix], ignore_index=True, ) if df_vulns is not None and not df_vulns.empty: @@ -242,7 +243,7 @@ def to_cdx(self, cdx_path, printinfo=True): vuln_components = pd.merge( left=vuln_grouped, right=self.df_sbomdb, - how="left", + how="inner", left_on=["package", "version"], right_on=["pname", "version"], )