Support Black Duck Hub as a snippet scanner #4632
Labels
Comments
sschuberth
added
new feature
|
Maybe also @JeroenKnoops's BlackDuck GitHub Action is of interest in this context. |
This comment was marked as resolved.
This comment was marked as resolved.
MarcelBochtler
changed the title
This comment was marked as resolved.
This comment was marked as resolved.
|
Hello, We are in the process of designing a common abstraction to represent the snippets in the ORT model. This abstraction will be submitted to the ORT community. Could someone provide a sample response of Blackduck (ideally on the Semver4j project), so we can have a look at their data model for snippets ? |
|
@nnobelis What kind of format do you require? The SPDX output? |
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 3, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties such as matched lines (present in both results) will be added in the future. Blackduck [2] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 3, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties such as matched lines (present in both results) will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 3, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties such as matched lines (present in both results) will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 3, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties such as matched lines (present in both results) will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 4, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 12, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 12, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 20, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 24, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
Apr 24, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
May 8, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
May 11, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are not License nor Copyright findings as a human operator needs to review them and either accept or flag them as false positives. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet Data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
May 11, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are difference in nature from License and Copyright findings as they reference a third party sourcecode. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
May 11, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are difference in nature from License and Copyright findings as they reference a third party sourcecode. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
May 11, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are difference in nature from License and Copyright findings as they reference a third party sourcecode. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
nnobelis
added a commit
to boschglobal/oss-review-toolkit
that referenced
this issue
May 12, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are difference in nature from License and Copyright findings as they reference a third party sourcecode. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet data model for ORT. Fixes: oss-review-toolkit#3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: oss-review-toolkit#4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
MarcelBochtler
pushed a commit
that referenced
this issue
May 15, 2023
Snippet scanners such as ScanOSS [1] and FossID [2] can identify code snippets potentially coming from a third party source. To do so, they scan the Internet for source code and build a Knowledge Base (KB). Then, the source code to check for snippets is scanned and compared against this KB. Snippet Findings are difference in nature from License and Copyright findings as they reference a third party sourcecode. Therefore, this commit adds a new property ORT data model in the `ScanSummary` to carry these snippet findings. This model has been created by comparing the results from FossID and ScanOSS and trying to find a common abstraction. This is currently the minimal model required to handle snippets. Further properties will be added in the future. Blackduck [3] is another scanner considered for integration in ORT [4] which supports snippets. However since it does not deliver snippets through its API, it was not considered when designing the snippet data model for ORT. Fixes: #3265. [1]: https://www.scanoss.com/ [2]: https://fossid.com/ [3]: https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html [4]: #4632 Signed-off-by: Nicolas Nobelis <nicolas.nobelis@bosch.io>
sschuberth
changed the title
sschuberth
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
As ORT is an orchestrator, it should allow to configure BlackDuck as scanner where code snippet can be scanned and result can be stored in ORT backend storage i.e. PostgreSQL
High Level Consideration
The text was updated successfully, but these errors were encountered: