microsoft / microsoft/OSSGadget

oss-detect-cryptography does not support sarif

Open
#348 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C#
Stars
371
Forks
58
PR merge metrics
No merged PRs in 30d

Description

Something in the command line parser for oss-detect-cryptography is broken:

PS C:\dev\source\github\OSSGadget\src\oss-detect-cryptography\bin\Debug\net6.0> .\oss-detect-cryptography.exe --format sarifv2 --output-file foo pkg:npm/left-pad@1.3.0

   ____   _____ _____    _____           _            _
  / __ \ / ____/ ____|  / ____|         | |          | |
 | |  | | (___| (___   | |  __  __ _  __| | __ _  ___| |_
 | |  | |\___ \\___ \  | | |_ |/ _` |/ _` |/ _` |/ _ \ __|
 | |__| |____) |___) | | |__| | (_| | (_| | (_| |  __/ |_
  \____/|_____/_____/   \_____|\__,_|\__,_|\__, |\___|\__|
                                            __/ |
                                           |___/
OSS Gadget - oss-detect-cryptography 0.1.342+eb2e002b5d - github.com/Microsoft/OSSGadget
WARN  - --format was neither a Package URL, directory, nor a file.
WARN  - sarifv2 was neither a Package URL, directory, nor a file.
WARN  - --output-file was neither a Package URL, directory, nor a file.
WARN  - foo was neither a Package URL, directory, nor a file.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the oss-detect-cryptography command-line entry point and reproduce the documented PowerShell command using --format sarifv2 and --output-file foo. Trace how these arguments are parsed versus package inputs; done means the flags are accepted and the command no longer warns that them or their values are packages.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.