scan C/C++ components in CycloneDX SBOM

[douglasclarke]

If I have a product built using a number of GitHub hosted C/C++ projects. They are included under the vendored pattern discussed in blog post. I would like to produce an SBOM including these dependencies such that osv-scanner would report vulnerabilities for the C/C++ packages in use.

Does osv-scanner have an expected format for the component in a cylconedx SBOM (eg. purl format) that would result in the components being correctly scanned for vulnerabilities?

[cuixq]

@douglasclarke thank you for your interests in OSV-Scanner!

We have documentation about scanning SBOM: https://google.github.io/osv-scanner/usage/scan-source#specify-sbom - does this answer you question?

[douglasclarke]

Not that I see. I am looking for the specifics of how to reference a GitHub reference in the cyclone SBOM to match against the GIT affected vulnerabilities in OSV.

Was assuming based on the PURL spec that pkg:github/namespace/name@tag would be the correct reference in the SBOM.

[oliverchang]

We don't support PURLs in the format you specified today unfortunately. The OSV API only supports querying by git commit hashes (google/osv.dev#3331 (comment)). This might work if there was a full commit hash we can extract from the encoded PURL.

That said, we might be able to make pkg:github/namespace/name@tag work also if we do this: google/osv.dev#3331 (comment)