Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vuln: canonical purl of standard library #71567

Closed
beatrausch opened this issue Feb 5, 2025 · 1 comment
Closed

x/vuln: canonical purl of standard library #71567

beatrausch opened this issue Feb 5, 2025 · 1 comment
Labels
vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Milestone
vuln/unplanned

Comments

@beatrausch
Copy link

beatrausch commented Feb 5, 2025 •
edited
Loading

Hi all,

I would like to clarify what the correct PURL (Package URL) for the golang standard library is. Currently different tools (trivy, cyclonedx-gomod) generate different PURLS:

As a consequence, when scanning SBOMs, depending on the PURL definition, CVEs cannot be found due to non matching PURLs.

Thx! Regards
@seankhliao seankhliao changed the title PURL of golang standard library x/vuln: canonical purl of standard library Feb 5, 2025
@gopherbot gopherbot added the vulncheck or vulndb Issues for the x/vuln or x/vulndb repo label Feb 5, 2025
@gopherbot gopherbot modified the milestones: Unreleased, vuln/unplanned Feb 5, 2025
@seankhliao
Copy link
Member

I think this can be grouped under #68152 (undecided on how we represent product ids).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Projects
None yet
Milestone
vuln/unplanned
Development

No branches or pull requests
3 participants
@gopherbot @seankhliao @beatrausch