sbom_advisories() lists the OSV advisories in an SBOM built with
advisories = TRUE, or with the path of a copy of OSV's CRAN all.zip:
those that OSV lists for the exact versions of its CRAN packages, from
the R Consortium advisory database. Matching is local, so no package name
leaves the machine; with advisories = TRUE, the CVSS ratings of the
upstream records are looked up at https://api.osv.dev, sending only
their public ids. The list is what OSV says about these exact versions:
a package without an advisory here is not shown to be free of flaws, and
a CVSS rating describes the upstream flaw, not how exposed the R package
is.
Value
A data frame with one row per advisory and component it affects,
sorted by id, then ref: id, the OSV id; the ref, name and
version of the component; the advisory's summary; published, the
date OSV published it; fixed, the version that fixes it, or NA;
no_fix, TRUE when the version is in a range of OSV's that has no
upper bound, so that OSV names no fix, and otherwise FALSE: fixed
NA with no_fix FALSE means that the fix is not known, as for a
version that OSV only lists; cves, its CVE ids joined with
", ", or NA; url, its page on osv.dev; and source_url, its
record in the R Consortium advisory database. In an SBOM read from a
document, a value its format does not carry is NA: CycloneDX and SPDX
3 do not carry fixed or no_fix, and SPDX 2 carries only those two.
For an SBOM built without advisories, or whose
advisory data could not be read when it was built, or read from a file
that lists none, it has no rows, and a message says so.
Details
An SBOM read with read_sbom() lists the OSV advisory listings its
document holds: CycloneDX vulnerabilities, SPDX 2 advisory references and
SPDX 3 vulnerabilities, as sbom writes them. Other tools' vulnerabilities
and VEX statements are not read. A SWID tag has no place for advisories.
Examples
x <- sbom_package(system.file("DESCRIPTION", package = "sbom"), system = FALSE)
sbom_advisories(x)
#> This SBOM was built without advisories; build it with `advisories = TRUE` to
#> list them.
#> [1] id ref name version summary published
#> [7] fixed no_fix cves url source_url
#> <0 rows> (or 0-length row.names)
if (FALSE) { # \dontrun{
# Needs the network: downloads OSV's CRAN export and looks up ratings.
y <- sbom_package(system.file("DESCRIPTION", package = "sbom"), system = FALSE, advisories = TRUE)
sbom_advisories(y)
} # }