fix(sbom): use nuget purl type for dotnet-core

[DmitriyLewen]

Description

use nuget purl type for dotnet-core

Before:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "serialNumber": "urn:uuid:fa54af43-7447-4a82-af53-b9f2e4130097",
  "version": 1,
  "metadata": {
    "timestamp": "2022-10-03T06:51:30+00:00",
    "tools": [
      {
        "vendor": "aquasecurity",
        "name": "trivy",
        "version": "0.32.1"
      }
    ],
    "component": {
      "bom-ref": "b41bce6c-bb5e-4429-ad43-7db3522c0219",
      "type": "application",
      "name": "datacollector.deps.json",
      "properties": [
        {
          "name": "aquasecurity:trivy:SchemaVersion",
          "value": "2"
        }
      ]
    }
  },
  "components": [
    {
      "bom-ref": "pkg:dotnet-core/Newtonsoft.Json@9.0.1",
      "type": "library",
      "name": "Newtonsoft.Json",
      "version": "9.0.1",
      "purl": "pkg:dotnet-core/Newtonsoft.Json@9.0.1",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "dotnet-core"
        }
      ]
    },
    {
      "bom-ref": "7c2c5f96-f93a-4f14-be8b-328cc416fc1e",
      "type": "application",
      "name": "datacollector.deps.json",
      "properties": [
        {
          "name": "aquasecurity:trivy:Type",
          "value": "dotnet-core"
        },
        {
          "name": "aquasecurity:trivy:Class",
          "value": "lang-pkgs"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "7c2c5f96-f93a-4f14-be8b-328cc416fc1e",
      "dependsOn": [
        "pkg:dotnet-core/Newtonsoft.Json@9.0.1"
      ]
    },
    {
      "ref": "b41bce6c-bb5e-4429-ad43-7db3522c0219",
      "dependsOn": [
        "7c2c5f96-f93a-4f14-be8b-328cc416fc1e"
      ]
    }
  ],
  "vulnerabilities": []
}

After:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "serialNumber": "urn:uuid:962826f6-cd5b-409f-95b0-ab7469aeb24b",
  "version": 1,
  "metadata": {
    "timestamp": "2022-10-03T07:12:14+00:00",
    "tools": [
      {
        "vendor": "aquasecurity",
        "name": "trivy",
        "version": "0.32.0-1-g3233dbd0"
      }
    ],
    "component": {
      "bom-ref": "54aafb2e-9042-4a28-b07c-09148179dfb1",
      "type": "application",
      "name": "datacollector.deps.json",
      "properties": [
        {
          "name": "aquasecurity:trivy:SchemaVersion",
          "value": "2"
        }
      ]
    }
  },
  "components": [
    {
      "bom-ref": "pkg:nuget/Newtonsoft.Json@9.0.1",
      "type": "library",
      "name": "Newtonsoft.Json",
      "version": "9.0.1",
      "purl": "pkg:nuget/Newtonsoft.Json@9.0.1",
      "properties": [
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "dotnet-core"
        }
      ]
    },
    {
      "bom-ref": "5327f4f7-0954-4559-9a1e-13dd9da0a939",
      "type": "application",
      "name": "datacollector.deps.json",
      "properties": [
        {
          "name": "aquasecurity:trivy:Type",
          "value": "dotnet-core"
        },
        {
          "name": "aquasecurity:trivy:Class",
          "value": "lang-pkgs"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "5327f4f7-0954-4559-9a1e-13dd9da0a939",
      "dependsOn": [
        "pkg:nuget/Newtonsoft.Json@9.0.1"
      ]
    },
    {
      "ref": "54aafb2e-9042-4a28-b07c-09148179dfb1",
      "dependsOn": [
        "5327f4f7-0954-4559-9a1e-13dd9da0a939"
      ]
    }
  ],
  "vulnerabilities": []
}
 

Related issues

• Close PURL format for nuget missing type #2842

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

It should be TypeDotNetDeps, no?

Suggested change

	case string(analyzer.TypeNuget), string(ftypes.DotNetCore):
	case string(analyzer.TypeNuget), string(analyzer. TypeDotNetDeps):

[knqyf263]

Also, I think we need to add TypeNuget here.

trivy/pkg/purl/purl.go

Lines 80 to 98 in 4c32b47

	func (p *PackageURL) AppType() string {
	switch p.Type {
	case packageurl.TypeComposer:
	return string(analyzer.TypeComposer)
	case packageurl.TypeMaven:
	return string(analyzer.TypeJar)
	case packageurl.TypeGem:
	return string(analyzer.TypeGemSpec)
	case packageurl.TypePyPi:
	return string(analyzer.TypePythonPkg)
	case packageurl.TypeGolang:
	return string(analyzer.TypeGoBinary)
	case packageurl.TypeNPM:
	return string(analyzer.TypeNodePkg)
	case packageurl.TypeCargo:
	return string(analyzer.TypeRustBinary)
	}
	return p.Type
	}

[DmitriyLewen]

Done