Feature Request: clamscan optional SARIF output format #1673
Description
Feature Request for clamscan to have a flag (--sarif or --format sarif) to output in Sarif format. This would make it easier to parse and check with existing sarif parsers and therefore enable a more smooth application of policy-as-code controls. This is especially useful in container/image scanning pipeline where multiple security tools already produce SARIF (e.g., semgrep, hadolint, grype)
for example:
{
"version": "2.1.0",
"$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.4.json",
"runs": [
{
"tool": {
"driver": {
"name": "ClamAV clamscan",
"informationUri": "https://www.clamav.net/",
"properties": {
"engineVersion": "X.Y.Z",
"dbVersion": "daily-12345"
}
}
},
"results": [
{
"ruleId": "Eicar-Test-Signature",
"level": "error",
"message": { "text": "Malware signature detected: Eicar-Test-Signature" },
"locations": [
{
"physicalLocation": {
"artifactLocation": { "uri": "path/to/infected/file" }
}
}
],
"properties": {
"category": "antivirus",
"result": "infected"
}
}
]
}
]
}
if no detections occur, then results can just be results: [] (this is what hadolint does).