guac: [ingestion bug] Failure due to missing purl attribute
Describe the bug A clear and concise description of what the bug is.
We tried to ingest sbom files (both CDX and SPDX) using the latest guacone binary (on the main branch) however it errors out for a few files. Following are the logs for the same.
"msg":"emit error: unable to assemble graphs: Node {<image-name>[sha256:95a7593269fc3344af31c8825e72da6f705dd753417581dd0391e0296ed81242] sha256:95a7593269fc3344af31c8825e72da6f705dd753417581dd0391e0296ed81242 [] [container] {file:///<file-absolute-path>.cdx.json FileCollector}} has no value for property purl","stacktrace":"github.com/guacsec/guac/pkg/handler/collector.Collect\n\t/Users/smenezes/dev/guac-exp/guac/pkg/handler/collector/collector.go:100\ngithub.com/guacsec/guac/cmd/guacone/cmd.glob..func5\n\t/Users/smenezes/dev/guac-exp/guac/cmd/guacone/cmd/files.go:169\ngithub.com/spf13/cobra.(*Command).execute\n\t/Users/smenezes/go/pkg/mod/github.com/spf13/cobra@v1.6.1/command.go:920\ngithub.com/spf13/cobra.(*Command).ExecuteC\n\t/Users/smenezes/go/pkg/mod/github.com/spf13/cobra@v1.6.1/command.go:1044\ngithub.com/spf13/cobra.(*Command).Execute\n\t/Users/smenezes/go/pkg/mod/github.com/spf13/cobra@v1.6.1/command.go:968\ngithub.com/guacsec/guac/cmd/guacone/cmd.Execute\n\t/Users/smenezes/dev/guac-exp/guac/cmd/guacone/cmd/root.go:104\nmain.main\n\t/Users/smenezes/dev/guac-exp/guac/cmd/guacone/main.go:23\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:250"}
To Reproduce Steps to reproduce the behavior:
- Go to ‘…’
- Click on ‘…’
- Scroll down to ‘…’
- See error
Expected behavior A clear and concise description of what you expected to happen.
Screenshots If applicable, add screenshots to help explain your problem.
GUAC version Are you using a released version of GUAC or one build from a commit in the repository? The one on the main branch.
Additional context Add any other context about the problem here.
About this issue
- Original URL
- State: closed
- Created a year ago
- Comments: 16 (8 by maintainers)
Hey @pxp928 yes we’re putting together a doc listing the gaps we’ve encountered and would like to discuss with you about the same. Will keep you posted once it’s ready thanks!
Would you be able to share the CDX SBOM’s top-level component name? Looks like it might be an issue with how we parse the name to create the purl.
Also,
unable to create entries in collectsub server, but continuing: unable to add collect entries: rpc error: code = Unavailable desc = connection erroris not an issue. This is for the collector subscriber server that runs to provide more insights via deps.dev and others. This is not needed for the ingestion to be successful (so that error can be ignored for now).