ppkarwasz commented on PR #4690:
URL: https://github.com/apache/solr/pull/4690#issuecomment-5201047290
I cross-checked the SBOM this PR generates against three external scanners,
all on the same `solr-11.0.0-SNAPSHOT.tgz`.
| | this PR (`bom-full.json`) | Syft
1.46 | cdxgen 11 `-t jar` | cdxgen 11 `-t gradle` |
|-----------------------------------------|---------------------------|-----------------------------|--------------------|-----------------------|
| components | 500 | 736
| 346 | 909 |
| dependency edges | 501 | 7
| 0 | 948 |
| licences | 500 / 500 | 286
/ 376 | 0 | 0 |
| SHA-256 hashes | 454 | on
paired `file` components | 0 | 0 |
| file locations (`evidence.occurrences`) | 364 | 0
| 0 | 0 |
| npm, vendored JS, wasm | 149 | none
| none | klibs only |
Where they overlap they agree: 346 of Syft's maven coordinates and 416 of
cdxgen's match ours exactly. The differences are scope, not disagreement.
**What the scanners add:** shaded dependencies read from embedded
`META-INF/maven/**/pom.properties`. We could pick those up later; Syft also
emits per-component CPEs, which we do not.
**What they miss:** the entire Admin UI supply chain. Both cdxgen modes and
Syft are Java-only here, so the 44 npm packages browserified into
`libs/solr/index.js`, the 15 vendored JavaScript files and the wasm UI are
invisible to them. That is the part of this PR no scanner replicates.
**Caveats on the tools.** cdxgen `-t jar` derives coordinates from filenames
and manifests, so 32 of its 35 extra entries are mis-parses of components we
already have (`[email protected]`,
`[email protected]`); only 3 were real.
cdxgen `-t gradle`
inventories the whole build rather than the distribution: it includes `ecj`,
`javacc` and junit, 70 unshipped Compose desktop variants, and 110 artifacts at
more than one version because it records requested rather than resolved
versions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
