feat(sbom): add manufacturer field to CycloneDX tools metadata #9019

krikera · 2025-06-09T18:00:05Z

Description

The manufacturer field improves human readability while keeping the existing group field for technical namespace purposes.

Add ToolManufacturer constant with value 'Aqua Security Software Ltd.'
Include manufacturer field in CycloneDX metadata tools component
Update test to expect the new manufacturer field

Related issues

Close feat(sbom): Add manufacturer field to CycloneDX tools metadata for better human readability #9014

Checklist

[✅ ] I've read the guidelines for contributing to this repository.
[✅ ] I've followed the conventions in the PR title.
[✅ ] I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

- Add ToolManufacturer constant with value 'Aqua Security Software Ltd.' - Include manufacturer field in CycloneDX metadata tools component - Update test to expect the new manufacturer field - Addresses GitHub issue #9014 for better human readability The manufacturer field improves human readability while keeping the existing group field for technical namespace purposes.

CLAassistant · 2025-06-09T18:00:11Z

All committers have signed the CLA.

CLAassistant · 2025-06-09T18:00:11Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

DmitriyLewen

Thanks for your contribution!

DmitriyLewen · 2025-06-10T04:11:43Z

Hello @krikera
Can you update integration (mage test:updateGolden command may help) and unit tests?

krikera · 2025-06-10T04:30:23Z

Hey @DmitriyLewen. Yeah sure!

knqyf263 · 2025-06-10T06:26:37Z

Actually, I found that mage test:updateGolden currently updates a lot of irrelevant files. We need to improve it. In this case, it might be faster to make the changes manually.

krikera · 2025-06-10T14:19:09Z

Hey @knqyf263 Should I update the integration test?

knqyf263 · 2025-06-10T14:20:45Z

You just need to update golden files. Please let us know if you need help.

krikera · 2025-06-10T14:29:57Z

Thanks. Yeah sure.

…dd manufacturer field to conda-cyclonedx.json.golden - Add manufacturer field to conda-environment-cyclonedx.json.golden - Add manufacturer field to pom-cyclonedx.json.golden Updates integration test golden files to expect the new manufacturer field in CycloneDX tools metadata as requested by reviewers.

knqyf263 · 2025-06-26T07:40:47Z

@krikera Do you have time to fix the tests? If not, @DmitriyLewen can you please take it over? We need to complete it for v0.64.0.

DmitriyLewen · 2025-06-26T07:42:30Z

okay, i will do that at this week

- update golden files for integration tests - update testcases for CycloneDX unit tests

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.63.0` -> `0.64.1` | --- ### Release Notes <details> <summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary> ### [`v0.64.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.64.1) [Compare Source](aquasecurity/trivy@v0.64.0...v0.64.1) #### Changelog - [`86ee3c1`](aquasecurity/trivy@86ee3c1) release: v0.64.1 \[release/v0.64] ([#9122](aquasecurity/trivy#9122)) - [`4e12722`](aquasecurity/trivy@4e12722) fix(misconf): skip rewriting expr if attr is nil \[backport: release/v0.64] ([#9127](aquasecurity/trivy#9127)) - [`9a7d384`](aquasecurity/trivy@9a7d384) fix(cli): Add more non-sensitive flags to telemetry \[backport: release/v0.64] ([#9124](aquasecurity/trivy#9124)) - [`53adfba`](aquasecurity/trivy@53adfba) fix(rootio): check full version to detect `root.io` packages \[backport: release/v0.64] ([#9120](aquasecurity/trivy#9120)) - [`8cf1bf9`](aquasecurity/trivy@8cf1bf9) fix(alma): parse epochs from rpmqa file \[backport: release/v0.64] ([#9119](aquasecurity/trivy#9119)) ### [`v0.64.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0640-2025-06-30) [Compare Source](aquasecurity/trivy@v0.63.0...v0.64.0) ##### Features - **cli:** add version constraints to annoucements ([#9023](aquasecurity/trivy#9023)) ([19efa9f](aquasecurity/trivy@19efa9f)) - **java:** dereference all maven settings.xml env placeholders ([#9024](aquasecurity/trivy#9024)) ([5aade69](aquasecurity/trivy@5aade69)) - **misconf:** add OpenTofu file extension support ([#8747](aquasecurity/trivy#8747)) ([57801d0](aquasecurity/trivy@57801d0)) - **misconf:** normalize CreatedBy for buildah and legacy docker builder ([#8953](aquasecurity/trivy#8953)) ([65e155f](aquasecurity/trivy@65e155f)) - **redhat:** Add EOL date for RHEL 10. ([#8910](aquasecurity/trivy#8910)) ([48258a7](aquasecurity/trivy@48258a7)) - reject unsupported artifact types in remote image retrieval ([#9052](aquasecurity/trivy#9052)) ([1e1e1b5](aquasecurity/trivy@1e1e1b5)) - **sbom:** add manufacturer field to CycloneDX tools metadata ([#9019](aquasecurity/trivy#9019)) ([41d0f94](aquasecurity/trivy@41d0f94)) - **terraform:** add partial evaluation for policy templates ([#8967](aquasecurity/trivy#8967)) ([a9f7dcd](aquasecurity/trivy@a9f7dcd)) - **ubuntu:** add end of life date for Ubuntu 25.04 ([#9077](aquasecurity/trivy#9077)) ([367564a](aquasecurity/trivy@367564a)) - **ubuntu:** add eol date for 20.04-ESM ([#8981](aquasecurity/trivy#8981)) ([87118a0](aquasecurity/trivy@87118a0)) - **vuln:** add Root.io support for container image scanning ([#9073](aquasecurity/trivy#9073)) ([3a0ec0f](aquasecurity/trivy@3a0ec0f)) ##### Bug Fixes - Add missing version check flags ([#8951](aquasecurity/trivy#8951)) ([ef5f8de](aquasecurity/trivy@ef5f8de)) - **cli:** add some values to the telemetry call ([#9056](aquasecurity/trivy#9056)) ([fd2bc91](aquasecurity/trivy@fd2bc91)) - Correctly check for semver versions for trivy version check ([#8948](aquasecurity/trivy#8948)) ([b813527](aquasecurity/trivy@b813527)) - don't show corrupted trivy-db warning for first run ([#8991](aquasecurity/trivy#8991)) ([4ed78e3](aquasecurity/trivy@4ed78e3)) - **misconf:** .Config.User always takes precedence over USER in .History ([#9050](aquasecurity/trivy#9050)) ([371b8cc](aquasecurity/trivy@371b8cc)) - **misconf:** correct Azure value-to-time conversion in AsTimeValue ([#9015](aquasecurity/trivy#9015)) ([40d017b](aquasecurity/trivy@40d017b)) - **misconf:** move disabled checks filtering after analyzer scan ([#9002](aquasecurity/trivy#9002)) ([a58c36d](aquasecurity/trivy@a58c36d)) - **misconf:** reduce log noise on incompatible check ([#9029](aquasecurity/trivy#9029)) ([99c5151](aquasecurity/trivy@99c5151)) - **nodejs:** correctly parse `packages` array of `bun.lock` file ([#8998](aquasecurity/trivy#8998)) ([875ec3a](aquasecurity/trivy@875ec3a)) - **report:** don't panic when report contains vulns, but doesn't contain packages for `table` format ([#8549](aquasecurity/trivy#8549)) ([87fda76](aquasecurity/trivy@87fda76)) - **sbom:** remove unnecessary OS detection check in SBOM decoding ([#9034](aquasecurity/trivy#9034)) ([198789a](aquasecurity/trivy@198789a)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/812 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

…ecurity#9019) Co-authored-by: DmitriyLewen <[email protected]>

krikera requested review from DmitriyLewen and knqyf263 as code owners June 9, 2025 18:00

DmitriyLewen approved these changes Jun 10, 2025

View reviewed changes

DmitriyLewen enabled auto-merge June 10, 2025 03:21

DmitriyLewen disabled auto-merge June 10, 2025 04:11

DmitriyLewen mentioned this pull request Jun 11, 2025

refactor(misconf): Remove ID and LongID for misconfiguration scanning #8959

Closed

6 tasks

test: update test data:

f9e2586

- update golden files for integration tests - update testcases for CycloneDX unit tests

DmitriyLewen added this pull request to the merge queue Jun 27, 2025

Merged via the queue into aquasecurity:main with commit 41d0f94 Jun 27, 2025
12 checks passed

aqua-bot mentioned this pull request Jun 27, 2025

release: v0.64.0 [main] #8955

Merged

yutatokoi pushed a commit to yutatokoi/trivy that referenced this pull request Aug 12, 2025

feat(sbom): add manufacturer field to CycloneDX tools metadata (aquas…

cc3381f

…ecurity#9019) Co-authored-by: DmitriyLewen <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(sbom): add manufacturer field to CycloneDX tools metadata #9019

feat(sbom): add manufacturer field to CycloneDX tools metadata #9019

Uh oh!

krikera commented Jun 9, 2025

Uh oh!

CLAassistant commented Jun 9, 2025 •

edited

Loading

Uh oh!

CLAassistant commented Jun 9, 2025

Uh oh!

DmitriyLewen left a comment

Uh oh!

DmitriyLewen commented Jun 10, 2025 •

edited

Loading

Uh oh!

krikera commented Jun 10, 2025

Uh oh!

knqyf263 commented Jun 10, 2025

Uh oh!

krikera commented Jun 10, 2025

Uh oh!

knqyf263 commented Jun 10, 2025

Uh oh!

krikera commented Jun 10, 2025

Uh oh!

knqyf263 commented Jun 26, 2025

Uh oh!

DmitriyLewen commented Jun 26, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

feat(sbom): add manufacturer field to CycloneDX tools metadata #9019

feat(sbom): add manufacturer field to CycloneDX tools metadata #9019

Uh oh!

Conversation

krikera commented Jun 9, 2025

Description

Related issues

Checklist

Uh oh!

CLAassistant commented Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Jun 9, 2025

Uh oh!

DmitriyLewen left a comment

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen commented Jun 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krikera commented Jun 10, 2025

Uh oh!

knqyf263 commented Jun 10, 2025

Uh oh!

krikera commented Jun 10, 2025

Uh oh!

knqyf263 commented Jun 10, 2025

Uh oh!

krikera commented Jun 10, 2025

Uh oh!

knqyf263 commented Jun 26, 2025

Uh oh!

DmitriyLewen commented Jun 26, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CLAassistant commented Jun 9, 2025 •

edited

Loading

DmitriyLewen commented Jun 10, 2025 •

edited

Loading