What is your suggestion?
Currently conanfile has an optional Metadata attribute author representing "Main maintainer/responsible for the package, any format".
CPE for vulnerability tracking is looking for 'vendor' in order to identify matching CVEs.
Example: CVE-2023-4039
The CPE provided is cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:arm64:*
'gnu' is the vendor specified for that CVE.
With only author available, for unpatched packages like gcc it would make sense to identify the upstream 'gnu' as 'author'. This will match any reported CVEs trivially.
For patched packages though, it's more complicated. Maybe we still want 'gnu' as the original vendor/author, but we also need the 'Maintainer' in order to contact them about new CVEs.
So, I'm asking for more attributes available to better identify different participants in the supply chain, to help with generating SBoMs easier, or just identifying who is responsible for what.
Ideas:
- Author
- Maintainer
- Packager
- Vendor
(I'm not sure these all fit Conan packages, just a list for consideration)
I'm sure there's a lot more complexity down the road of SBoM generation for Conan, but just having more attributes to start with saving provenance metadata in recipes will be a very helpful step.
It would also be handy to have a way to define or override attributes like this the same way we can for options and settings but that's a separate issue. CI would want to globally define 'packager' or 'vendor' for instance.
Have you read the CONTRIBUTING guide?
What is your suggestion?
Currently
conanfilehas an optional Metadata attributeauthorrepresenting "Main maintainer/responsible for the package, any format".CPE for vulnerability tracking is looking for 'vendor' in order to identify matching CVEs.
Example: CVE-2023-4039
The CPE provided is
cpe:2.3:a:gnu:gcc:*:*:*:*:*:*:arm64:*'gnu' is the vendor specified for that CVE.
With only
authoravailable, for unpatched packages likegccit would make sense to identify the upstream 'gnu' as 'author'. This will match any reported CVEs trivially.For patched packages though, it's more complicated. Maybe we still want 'gnu' as the original vendor/author, but we also need the 'Maintainer' in order to contact them about new CVEs.
So, I'm asking for more attributes available to better identify different participants in the supply chain, to help with generating SBoMs easier, or just identifying who is responsible for what.
Ideas:
(I'm not sure these all fit Conan packages, just a list for consideration)
I'm sure there's a lot more complexity down the road of SBoM generation for Conan, but just having more attributes to start with saving provenance metadata in recipes will be a very helpful step.
It would also be handy to have a way to define or override attributes like this the same way we can for options and settings but that's a separate issue. CI would want to globally define 'packager' or 'vendor' for instance.
Have you read the CONTRIBUTING guide?