SAST report generated from cargo cargo audit invalid
cargo-audit 0.17.6 gitlab-report 0.1.10 OpenBSD 7.3
The generated SAST report uploaded to Gitlab appears to be invalid. The SAST file was generated as documented in the comments in main.rs
: LD_LIBRARY_PATH=/usr/local/lib/eopenssl31 cargo audit --json | gitlab-report -p audit -f gl-sast > gl-sast-report.json
When uploaded to gitlab, I get the following error messages:
[Schema] Version 2.0 for report type sast is unsupported, supported versions for this report type are: 15.0.0, 15.0.1, 15.0.2, 15.0.4, 15.0.5, 15.0.6. GitLab will attempt to validate this report against the earliest supported versions of this report type, to show all the errors but will not ingest the report
[Schema] property '/version' does not match pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
[Schema] property '/scan' is not of type: object
The uploaded report looks like the following:
{"version":"2.0","scan":null,"vulnerabilities":[],"remediations":[],"dependency_files":[]}
Edit: I seem to have a similar issue when doing this with dependency scanning as well.
[Schema] Version 2.0 for report type dependency_scanning is unsupported, supported versions for this report type are: 15.0.0, 15.0.1, 15.0.2, 15.0.4, 15.0.5, 15.0.6. GitLab will attempt to validate this report against the earliest supported versions of this report type, to show all the errors but will not ingest the report
[Schema] property '/version' does not match pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
[Schema] property '/scan' is not of type: object
{"version":"2.0","scan":null,"vulnerabilities":[],"remediations":[],"dependency_files":[]}
Edited by William Orr