Skip to content

Commit 256f54c

Browse files
dlg1206dlg1206
authored
Merge pull request #218 from SoftwareDesignLab/dev
Plugfest-in-a-box v1beta
2 parents 75a331e + b6e7eaa commit 256f54c

File tree

160 files changed

+17643
-7355
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

160 files changed

+17643
-7355
lines changed

‎.github/ISSUE_TEMPLATE/action-item.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
name: Action Item
3+
about: Action Item to complete
4+
title: ''
5+
labels: ''
6+
assignees: ''
7+
8+
---
9+
10+
# Overview
11+
12+
_Description Here_
13+
14+
## Acceptance Criteria
15+
16+
- [ ] _Acceptance Criteria Here_

‎.github/workflows/build.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Build Plugfest
2+
on:
3+
push:
4+
# Exclude prod/dev branches since they are built and tested
5+
branches-ignore:
6+
- 'dev' # todo: replace with vars
7+
- 'main' # todo: replace with vars
8+
paths-ignore:
9+
- '**/sample_boms/**'
10+
- '**/sample_sboms/**'
11+
jobs:
12+
build:
13+
runs-on: windows-latest
14+
steps:
15+
- name: checkout
16+
uses: actions/[email protected]
17+
18+
- name: Set up JDK 17
19+
uses: actions/setup-java@v3
20+
with:
21+
java-version: '17'
22+
distribution: 'temurin'
23+
24+
- name: Setup Gradle
25+
uses: gradle/gradle-build-action@v2
26+
27+
- name: Build Plugfest
28+
run: ./gradlew clean build -x test

‎.github/workflows/generate-sbom.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Syft SBOM Generation
2+
on:
3+
push:
4+
paths-ignore:
5+
- '**/sample_boms/**'
6+
- '**/sample_sboms/**'
7+
8+
jobs:
9+
get-sbom-type:
10+
runs-on: ubuntu-latest
11+
outputs:
12+
sbom-type: ${{ steps.sbom-type.outputs.type }}
13+
steps:
14+
- name: Get SBOM type
15+
id: sbom-type
16+
run: |
17+
case ${GITHUB_REF##*/} in
18+
${{ vars.PROD_BRANCH }}) echo "type=production" >> "$GITHUB_OUTPUT";;
19+
${{ vars.DEV_BRANCH }}) echo "type=dev" >> "$GITHUB_OUTPUT";;
20+
*) echo "type=snapshot" >> "$GITHUB_OUTPUT";;
21+
esac
22+
23+
gen-sboms:
24+
runs-on: ubuntu-latest
25+
needs: get-sbom-type
26+
env:
27+
SBOM_TYPE: ${{ needs.get-sbom-type.outputs.sbom-type }}
28+
steps:
29+
30+
- name: checkout
31+
uses: actions/[email protected]
32+
33+
- name: spdx-sbom
34+
uses: anchore/[email protected]
35+
with:
36+
format: spdx
37+
artifact-name: plugfest-sbom-${{ env.SBOM_TYPE }}.spdx
38+
39+
- name: cyclonedx-sbom
40+
uses: anchore/[email protected]
41+
with:
42+
format: cyclonedx-json
43+
artifact-name: plugfest-sbom-cdx-${{ env.SBOM_TYPE }}.json

‎.github/workflows/test.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Build and Test Plugfest
2+
on:
3+
push:
4+
branches:
5+
- 'dev' # todo: replace with vars
6+
- 'main' # todo: replace with vars
7+
paths-ignore:
8+
- '**/sample_boms/**'
9+
- '**/sample_sboms/**'
10+
pull_request:
11+
branches:
12+
- 'dev' # todo: replace with vars
13+
- 'main' # todo: replace with vars
14+
paths-ignore:
15+
- '**/sample_boms/**'
16+
- '**/sample_sboms/**'
17+
jobs:
18+
build-test:
19+
runs-on: windows-latest
20+
steps:
21+
- name: checkout
22+
uses: actions/[email protected]
23+
24+
- name: Set up JDK 17
25+
uses: actions/setup-java@v3
26+
with:
27+
java-version: '17'
28+
distribution: 'temurin'
29+
30+
- name: Setup Gradle
31+
uses: gradle/gradle-build-action@v2
32+
33+
- name: Build and Test Plugfest
34+
run: ./gradlew clean build
35+
36+
- name: Store Report
37+
uses: actions/upload-artifact@v3
38+
if: always()
39+
with:
40+
name: reports
41+
path: "**/build/reports/"
42+
43+
- name: Report Failure
44+
if: failure()
45+
run: echo "::error::Some Tests Failed, see the artifacts for details"

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,7 @@ gradle-app.setting
5252
# Angular
5353
/node_modules/
5454
core/bin
55-
*.spdx
55+
*.spdx
56+
57+
# Excluded test driver class used for testing
58+
TestMain.java

‎README.md‎

Lines changed: 93 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,95 @@
1-
# PlugFest Tooling
2-
> A collection of tools to compare the usage and quality of different SBOM generators
3-
>
4-
> ## v3.2.0 -- 5/9/23
5-
> ### API
6-
> - Fixed another bug preventing non-ASCII characters from being processed
7-
> ### Comparison
8-
> - Allow marking of components as appearing in target SBOM
9-
> ### Metrics
10-
> - Fix bug causing formatting issues with the data verification test
11-
> ### GUI
12-
> - Added individual loading spinners for each uploaded SBOM
13-
14-
## Differ
15-
- Compares two SBOMs supporting CycloneDX XML and SPDX Tag-Value
16-
- Allows comparison between CycloneDX and SPDX formats
17-
- Displays differences in trivial SBOM attributes like publisher and timestamp
18-
- Displays differences in found component data between SBOMs
19-
- Version number
20-
- Publisher
21-
- CPEs
22-
- PURLs
23-
- SWIDs
24-
- Summarizes the report in a Unix-diff-like print
1+
# PlugFest-in-a-Box Tool
2+
### v1.0.0-beta
3+
[changelog](changelog.md)
4+
> PlugFest-in-a-Box is a powerful tool to reveal key areas of difference between several Software Bills of Materials
5+
> (SBOMs) and applying thorough metrics to identify any and all quality issues.
6+
7+
8+
## Supported SBOM Formats
9+
- CycloneDX 1.4 JSON
10+
- CycloneDX 1.4 XML
11+
- SPDX 2.3 Tag-Value
2512

26-
## Comparison
27-
- Generate detailed DiffReports from a target SBOM and a list of SBOMs.
28-
29-
## Quality Attributes
30-
- Actionable Test
31-
- Tests fields to ensure data contained is usable.
32-
- Completeness Test
33-
- Checks to make sure components have a name, publisher, version
34-
- Checks if attributes are formatted correctly and checks CPE and PURL formatting
35-
- Data Verification Test
36-
- Uses PURLs to search for information about the package using package manager APIs
37-
- Confirms that name and publisher match resource
38-
- Also checks to see if the assigned version number exists in resource
39-
40-
## Translator
41-
- Parse SBOMS from files and deserialize from formats:
42-
- CycloneDX
43-
> .xml and .json
44-
- SPDX
45-
> .spdx
46-
## System Requirements
47-
- Java 17
48-
> Check: `java -version`
4913

5014
## Quick Start
51-
### Backend
52-
1. `./gradlew bootJar`
53-
2. `java -jar .\api\build\libs\api-3.1.0.jar`
54-
### Frontend
15+
> See [System Requirements](doc/README.md) for more details
5516
1. `cd gui`
56-
2. `npm install`
57-
3. `npm start`
17+
2. `npm -ci`
18+
3. `npm run start`
19+
20+
21+
## Comparison
22+
> Allows comparison across schemas and file formats
23+
24+
### SBOM Conflicts
25+
- **Supplier**: Supplier of the code are not the same (publisher)
26+
- **Author**: SBOMs have different authors
27+
- **Timestamp**: SBOMs have different timestamps
28+
- **Origin Format**: SBOMs have different origin formats
29+
- **Schema Version**: SBOMs have different schema versions (CycloneDX 1.4, SPDX 2.3, etc)
30+
- **SBOM Version**: SBOMs have different versions
31+
- **Serial Number**: SBOMs have different serial numbers
32+
33+
### Component Conflicts
34+
- **Missing**: Component only found in one SBOM
35+
- **Version**: Component found in both SBOMs, but has different versions
36+
- **License**: Component found in both SBOMs, but has different licenses
37+
- **Publisher**: Component found in both SBOMs, but has different publisher
38+
- **CPE**: Component found in both SBOMs, but has different CPE
39+
- **PURL**: Component found in both SBOMs, but has different PURL
40+
- **Hash**: Component found in both SBOMs, but has different Hashes
41+
42+
43+
## Metrics
44+
> A series of metrics to access the quality of the SBOM.
45+
46+
### Completeness
47+
> Accesses how complete the content of the SBOM is.
48+
- **Minimum Elements Test**: Checks for the [Minimum Elements for an SBOM](https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf)
49+
are present as recommend by the NTIA.
50+
- _Supplier Name_: The name of an entity that creates, defines, and identifies components.
51+
- _Component Name_: Designation assigned to a unit of software defined by the original supplier.
52+
- _Version of the Component_: Identifier used by the supplier to specify a change in software from a previously identified version.
53+
- _Other Unique Identifiers_: Other identifiers that are used to identify a component, or serve as a look-up key for relevant databases.
54+
> Plugfest uses CPE and PURL
55+
- _Author of SBOM Data_: The name of the entity that creates the SBOM data for this
56+
component.
57+
- _Timestamp_: Record of the date and time of the SBOM data assembly
58+
- **Valid PURL Test**: Test to see if the PURL is correctly formatted
59+
- **Valid CPE Test**: Test to see if the CPE is correctly formatted
60+
61+
### Uniqueness
62+
> Accesses the quality of the unique identifiers and ensure they match the stored SBOM data.
63+
- **Has Hash Data Test**: Test to see if hashes are stored
64+
- **Valid Hash Data Test**: Test to see the stored hashes match the reported hash algorithm
65+
- **Accurate PURL Test**: Test to see if the data stored in the PURL matches what is reported in the SBOM
66+
- **Accurate CPE Test**: Test to see if the data stored in the CPE matches what is reported in the SBOM
67+
68+
### Registered
69+
> Accesses if the component is stored in a default repository
70+
- **Is Registered Test**: Uses PURLs to verify if the component exists in the [default PURL repository](https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst)
71+
72+
### Licensing
73+
> Accesses if the SBOM has valid license data
74+
- **Has License Data Test**: Test to see if Licenses are stored
75+
- **Valid SPDX License Test**: Test to see if the License is stored in the [SPDX License List](https://spdx.org/licenses/) and if they are depreciated
76+
77+
### SPDX
78+
> Accesses for features that are required specifically for [SPDX SBOMs](https://spdx.github.io/spdx-spec/v2.3/).
79+
- **Has Data License SPDX Test**: Test to see if the SBOM's DataLicense field contain the CC0-1.0 license
80+
- **Has SPDX ID Test**: Test to see if each component has a valid SPDXID
81+
- **Has Document Namespace Test**: Test to see if the SBOM contains a valid document namespace
82+
- **Has Download Location Test**: Test to see if each component has a download location
83+
- **Has Creation Info Test**: Test to see if the SBOM contains creation information
84+
- **Has Verification Code Test**: Test to see if each component has a package verification code (FilesAnalyzed is true) or is it omitted (FilesAnalyzed if false)
85+
- **Has Extracted Licenses Test**: Test to see if there are any extracted licenses not on the SPDX license list in the SBOM
86+
- **Extracted License Minimum Element Test**: Test to see if the extracted licenses contain the required fields LicenseName, LicenseID, and LicenseCrossReference
87+
88+
### CycloneDX
89+
> Accesses for features that are required specifically for [CycloneDX SBOMs](https://cyclonedx.org/specification/overview/).
90+
- **Has Bom-Ref Test**: Test to see if a component has a unique bom-ref to reference inside the SBOM
91+
- **Has Bom Version Test**: Test to see if the SBOM has a version number declared
92+
5893

5994
## Contributors
6095
**Principal Investigator:** [Mehdi Mirakhorli](mailto:[email protected])
@@ -65,14 +100,18 @@
65100

66101
**Developer Team Leads**
67102
- [Tina DiLorenzo](mailto:[email protected])
103+
- [Tyler Drake](mailto:[email protected])
68104
- [Matt London](mailto:[email protected])
69105
- [Dylan Mulligan](mailto:[email protected])
70106

71107
**Developer Team**
72-
- [Tyler Drake](mailto:[email protected])
108+
- [Michael Alfonzetti](mailto:[email protected])
73109
- [Ian Dunn](mailto:[email protected])
74110
- [Asa Horn](mailto:[email protected])
75111
- [Justin Jantzi](mailto:[email protected])
112+
- [Ping Liu](mailto:[email protected])
113+
- [Matthew Morrison](mailto:[email protected])
114+
- [Ethan Numan](mailto:[email protected])
76115
- [Henry Orsagh](mailto:[email protected])
77116
- [Juan Francisco Patino](mailto:[email protected])
78117
- [Max Stein](mailto:[email protected])

0 commit comments

Comments
 (0)