4 ms·

Vulnerability scanner written in Go that uses osv.dev data

162 points by GavCo 4y ago

WalterSobchak 4y ago
Blog post: https://security.googleblog.com/2022/12/announcing-osv-scanner-vulnerability.html https://security.googleblog.com/2022/12/announcing-osv-scann...
dlor 4y ago
This type of friendly tooling is exactly what was missing from OSV! I look forward to OSV making it easier to manage and deal with vulnerabilities.
ashishbijlani 4y ago
Great to see a developer-friendly tool around OSV! Packj [1] uses OSV APIs to report vulnerable PyPI/NPM/Rubygems packages. Disclaimer: I built it. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj flags malicious/risky packages.
technics256 4y ago
This is really helpful to diversify the current oss tools. Does anyone know good sources for creating a SBOM?
- dlor 4y ago
  Depends exactly what you're trying to create it for. I advocate for doing it during the build process rather than as a step after. We open sourced a few tools that do it automatically for containers: https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/melange https://github.com/chainguard-dev/melange
- citruscomputing 4y ago
  I've used the cyclonedx maven plugin, cyclonedx-bom on pypi, cdxgen for js, and cyclonedx-cli for various utilities (e.g. merging). All have worked great.
jicea 4y ago
I wasn’t aware that Gradle has «gradle.lockfile» that describes the dependencies tree. Is it used in the Java/Kotlin world?
- jamesfinlayson 4y ago
  I use Gradle regularly and have never come across it. Looks like it might be opt-in: https://docs.gradle.org/current/userguide/dependency_locking.html#enabling_locking_on_configurations https://docs.gradle.org/current/userguide/dependency_locking... That said, all the Gradle projects I've used have pinned to specific versions rather than ranges.
xiwenc 4y ago
I like trivy[1] a lot. Nice to see more alternatives like this. 1. https://github.com/aquasecurity/trivy https://github.com/aquasecurity/trivy
wankle 4y ago
What was the reason for choosing Go? Java is far more widely supported in the world.
- dralley 4y ago
  Not for CLI tools.
chronial 4y ago
How would you use this with a C/C++ codebase, where you build your dependencies yourself and don't get them from a package manager? All vulnerability databases seem to refer to package repos. Is there anything that works with only library name + version?
- ashishbijlani 4y ago
  We've an open-source project that does this: https://github.com/osssanitizer/maloss https://github.com/osssanitizer/maloss I'm working on creating a CLI/web interface for this. Happy to chat (email in profile).
- halbecaf 4y ago
  OSV lead here. This isn't available yet, but we're working on exactly this in two ways: 1. Extending our API to detect vendored C/C++ code by building an file hash index 2. Building a high quality C/C++ vulnerability database. You can follow the two linked issues here: https://github.com/google/osv-scanner/issues/82 https://github.com/google/osv-scanner/issues/82 for updates!

162 points by GavCo 4y ago

Blog post: https://security.googleblog.com/2022/12/announcing-osv-scanner-vulnerability.html https://security.googleblog.com/2022/12/announcing-osv-scann...

dlor 4y ago

This type of friendly tooling is exactly what was missing from OSV! I look forward to OSV making it easier to manage and deal with vulnerabilities.

ashishbijlani 4y ago

Great to see a developer-friendly tool around OSV! Packj [1] uses OSV APIs to report vulnerable PyPI/NPM/Rubygems packages. Disclaimer: I built it. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj flags malicious/risky packages.

technics256 4y ago

This is really helpful to diversify the current oss tools. Does anyone know good sources for creating a SBOM?

dlor 4y ago
Depends exactly what you're trying to create it for. I advocate for doing it during the build process rather than as a step after. We open sourced a few tools that do it automatically for containers: https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/melange https://github.com/chainguard-dev/melange
citruscomputing 4y ago
I've used the cyclonedx maven plugin, cyclonedx-bom on pypi, cdxgen for js, and cyclonedx-cli for various utilities (e.g. merging). All have worked great.

jicea 4y ago

I wasn’t aware that Gradle has «gradle.lockfile» that describes the dependencies tree. Is it used in the Java/Kotlin world?

jamesfinlayson 4y ago
I use Gradle regularly and have never come across it. Looks like it might be opt-in: https://docs.gradle.org/current/userguide/dependency_locking.html#enabling_locking_on_configurations https://docs.gradle.org/current/userguide/dependency_locking... That said, all the Gradle projects I've used have pinned to specific versions rather than ranges.

xiwenc 4y ago

I like trivy[1] a lot. Nice to see more alternatives like this. 1. https://github.com/aquasecurity/trivy https://github.com/aquasecurity/trivy

wankle 4y ago

What was the reason for choosing Go? Java is far more widely supported in the world.

dralley 4y ago
Not for CLI tools.

chronial 4y ago

How would you use this with a C/C++ codebase, where you build your dependencies yourself and don't get them from a package manager? All vulnerability databases seem to refer to package repos. Is there anything that works with only library name + version?

ashishbijlani 4y ago
We've an open-source project that does this: https://github.com/osssanitizer/maloss https://github.com/osssanitizer/maloss I'm working on creating a CLI/web interface for this. Happy to chat (email in profile).
halbecaf 4y ago
OSV lead here. This isn't available yet, but we're working on exactly this in two ways: 1. Extending our API to detect vendored C/C++ code by building an file hash index 2. Building a high quality C/C++ vulnerability database. You can follow the two linked issues here: https://github.com/google/osv-scanner/issues/82 https://github.com/google/osv-scanner/issues/82 for updates!