Share your feedback on OSV-Scanner v2 beta

[hogo6002]

Hi everyone, this discussion thread is for gathering feedback on the newly released OSV-Scanner v2 beta. Your thoughts will help us improve the official v2 release.

For container scanning feedback, please comment here.

[bestbeforetoday]

v2.0.0-beta1 is unable to use SBOMs generated for Node.js packages by the npm sbom command. I see the same failure with both SPDX and CycloneDX SBOMs. v1.9.2 works fine.

Failed to parse SBOM ".../sbom.json" with error: could not determine extractor suitable to this file
could not determine extractor suitable to this file

I'm not sure if you prefer issue reports here or as a GitHub issue while still in beta.

Edit: I did some experimenting and v2.0.0-beta1 will recognise the SBOMs, but only if the file has the file extension .cdx.json for a CycloneDX SBOM, or .spdx.json for an SPDX SBOM. Despite being one of the recognised file patterns in the CycloneDX spec, bom.json is not recognised. My expectation was for any filename to be accepted since it has been explicitly passed as an argument to the --sbom option, which is what I see with v1.9.2. I could understand a change to require a specific file extension but it needs to be clearly documented.

[another-rex]

Thanks for the report, I have opened google/osv-scalibr#429 to fix this issue.

Because there are many different possible file formats for a SBOM file, we use the file name to determine which extractor to use. I'll update the documentation and --help to make this more explicit.