Skip to content

Commit ecc01bb

Browse files
DmitriyLewenknqyf263
DmitriyLewen
and
knqyf263
authored
fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)
Co-authored-by: knqyf263 <[email protected]>
1 parent e58dcfc commit ecc01bb

File tree

4 files changed

+183
-6
lines changed

4 files changed

+183
-6
lines changed

‎docs/docs/target/container_image.md

+14-2
Original file line numberDiff line numberDiff line change
@@ -411,9 +411,20 @@ Trivy supports the generation of Software Bill of Materials (SBOM) for container
411411

412412
### Generation
413413
Trivy can generate SBOM for container images.
414-
See [here](../supply-chain/sbom.md) for the detail.
414+
See [here](../supply-chain/sbom.md) for details.
415415

416-
### Discovery
416+
### Discover SBOM inside container images
417+
Trivy can search for Software Bill of Materials (SBOMs) within container image files and scan their components for vulnerabilities.
418+
419+
#### Third-party SBOM files
420+
SBOM specifications define key requirements for component documentation[^2].
421+
However, different tools and systems often have varying approaches to documenting component types and their relationships.
422+
423+
Due to these variations, Trivy cannot always accurately interpret SBOMs generated by other tools.
424+
For example, it may have difficulty determining the correct file paths to component information files (such as lock files or binaries).
425+
In such cases, Trivy uses the path to the scanned SBOM file itself to maintain traceability and ensure accurate dependency reporting.
426+
427+
### Discover SBOM referencing the container image
417428
Trivy can search for Software Bill of Materials (SBOMs) that reference container images.
418429
If an SBOM is found, the vulnerability scan is performed using the SBOM instead of the container image.
419430
By using the SBOM, you can perform a vulnerability scan more quickly, as it allows you to skip pulling the container image and analyzing its layers.
@@ -559,3 +570,4 @@ Error: uncompressed image size (15GB) exceeds maximum allowed size (10GB)
559570
```
560571

561572
[^1]: Trivy uses decimal (SI) prefixes (based on 1000) for size.
573+
[^2]: SPDX uses `package` instead of `component`.

‎pkg/fanal/analyzer/sbom/sbom.go

+7-4
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"context"
55
"os"
66
"path"
7-
"slices"
87
"strings"
98

109
"golang.org/x/xerrors"
@@ -58,10 +57,14 @@ func (a sbomAnalyzer) Analyze(ctx context.Context, input analyzer.AnalysisInput)
5857
bom.Packages[i].FilePath = path.Join(input.FilePath, pkgInfo.FilePath)
5958
}
6059

61-
// FilePath for apps with aggregatingTypes is empty.
62-
// Set the SBOM file path as Application.FilePath to correctly overwrite applications when merging layers.
60+
// There are cases when FilePath for Application is empty:
61+
// - FilePath for apps with aggregatingTypes is empty.
62+
// - Third party SBOM without Application component.
63+
// We need to use SBOM file path as Application.FilePath to correctly:
64+
// - overwrite applications when merging layers. See https://github.com/aquasecurity/trivy/issues/7851
65+
// - show FilePath as Target of Application. See https://github.com/aquasecurity/trivy/issues/8189.
6366
for i, app := range bom.Applications {
64-
if slices.Contains(ftypes.AggregatingTypes, app.Type) && app.FilePath == "" {
67+
if app.FilePath == "" {
6568
bom.Applications[i].FilePath = input.FilePath
6669
}
6770
}

‎pkg/fanal/analyzer/sbom/sbom_test.go

+51
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,57 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
165165
},
166166
wantErr: require.NoError,
167167
},
168+
{
169+
name: "valid sbom spdx file without application component",
170+
file: "testdata/sbom-without-app-component.spdx.json",
171+
filePath: "layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json",
172+
want: &analyzer.AnalysisResult{
173+
Applications: []types.Application{
174+
{
175+
Type: types.GoBinary,
176+
FilePath: "layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json",
177+
Packages: types.Packages{
178+
{
179+
ID: "github.com/buildpacks/[email protected]",
180+
Name: "github.com/buildpacks/lifecycle",
181+
Version: "v0.20.2",
182+
Identifier: types.PkgIdentifier{
183+
PURL: &packageurl.PackageURL{
184+
Type: packageurl.TypeGolang,
185+
Namespace: "github.com/buildpacks",
186+
Name: "lifecycle",
187+
Version: "v0.20.2",
188+
},
189+
},
190+
Licenses: []string{
191+
"NOASSERTION",
192+
},
193+
},
194+
},
195+
},
196+
{
197+
Type: types.Jar,
198+
FilePath: "layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json",
199+
Packages: types.Packages{
200+
{
201+
ID: "co.elastic.apm:apm-agent:1.36.0",
202+
Name: "co.elastic.apm:apm-agent",
203+
Version: "1.36.0",
204+
Identifier: types.PkgIdentifier{
205+
PURL: &packageurl.PackageURL{
206+
Type: packageurl.TypeMaven,
207+
Namespace: "co.elastic.apm",
208+
Name: "apm-agent",
209+
Version: "1.36.0",
210+
},
211+
},
212+
},
213+
},
214+
},
215+
},
216+
},
217+
wantErr: require.NoError,
218+
},
168219
{
169220
name: "valid postgresql spdx file",
170221
file: "testdata/postgresql.spdx.json",

‎pkg/fanal/analyzer/sbom/testdata/sbom-without-app-component.spdx.json

+111
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
{
2+
"spdxVersion": "SPDX-2.3",
3+
"dataLicense": "CC0-1.0",
4+
"SPDXID": "SPDXRef-DOCUMENT",
5+
"name": "launcher",
6+
"documentNamespace": "https://anchore.com/syft/file/launcher-268e7779-ba66-4422-a5b0-d4d83f7b5d8c",
7+
"creationInfo": {
8+
"licenseListVersion": "3.25",
9+
"creators": [
10+
"Organization: Anchore, Inc",
11+
"Tool: syft-1.13.0"
12+
],
13+
"created": "2024-09-25T21:11:50Z"
14+
},
15+
"packages": [
16+
{
17+
"name": "co.elastic.apm:apm-agent",
18+
"SPDXID": "SPDXRef-Package-f0db45781e6813a1",
19+
"versionInfo": "1.36.0",
20+
"supplier": "NOASSERTION",
21+
"downloadLocation": "NONE",
22+
"licenseConcluded": "NONE",
23+
"licenseDeclared": "NONE",
24+
"copyrightText": "NOASSERTION",
25+
"externalRefs": [
26+
{
27+
"referenceCategory": "PACKAGE_MANAGER",
28+
"referenceType": "purl",
29+
"referenceLocator": "pkg:maven/co.elastic.apm/[email protected]"
30+
}
31+
],
32+
"filesAnalyzed": false
33+
},
34+
{
35+
"name": "github.com/buildpacks/lifecycle",
36+
"SPDXID": "SPDXRef-Package-go-module-github.com-buildpacks-lifecycle-89c3bd8d4c2e75b7",
37+
"versionInfo": "v0.20.2",
38+
"supplier": "NOASSERTION",
39+
"downloadLocation": "NOASSERTION",
40+
"filesAnalyzed": false,
41+
"sourceInfo": "acquired package info from go module information: /launcher",
42+
"licenseConcluded": "NOASSERTION",
43+
"licenseDeclared": "NOASSERTION",
44+
"copyrightText": "NOASSERTION",
45+
"externalRefs": [
46+
{
47+
"referenceCategory": "SECURITY",
48+
"referenceType": "cpe23Type",
49+
"referenceLocator": "cpe:2.3:a:buildpacks:lifecycle:v0.20.2:*:*:*:*:*:*:*"
50+
},
51+
{
52+
"referenceCategory": "PACKAGE-MANAGER",
53+
"referenceType": "purl",
54+
"referenceLocator": "pkg:golang/github.com/buildpacks/[email protected]"
55+
}
56+
]
57+
},
58+
{
59+
"name": "launcher",
60+
"SPDXID": "SPDXRef-DocumentRoot-File-launcher",
61+
"versionInfo": "sha256:716665ae98fb4b4675d5184f80884547597d47be1395d1049dc9e16035f32cc1",
62+
"supplier": "NOASSERTION",
63+
"downloadLocation": "NOASSERTION",
64+
"filesAnalyzed": false,
65+
"checksums": [
66+
{
67+
"algorithm": "SHA256",
68+
"checksumValue": "716665ae98fb4b4675d5184f80884547597d47be1395d1049dc9e16035f32cc1"
69+
}
70+
],
71+
"licenseConcluded": "NOASSERTION",
72+
"licenseDeclared": "NOASSERTION",
73+
"primaryPackagePurpose": "FILE"
74+
}
75+
],
76+
"files": [
77+
{
78+
"fileName": "/launcher",
79+
"SPDXID": "SPDXRef-File-launcher-361242815a383bec",
80+
"checksums": [
81+
{
82+
"algorithm": "SHA1",
83+
"checksumValue": "0000000000000000000000000000000000000000"
84+
}
85+
],
86+
"licenseConcluded": "NOASSERTION",
87+
"licenseInfoInFiles": [
88+
"NOASSERTION"
89+
],
90+
"copyrightText": ""
91+
}
92+
],
93+
"relationships": [
94+
{
95+
"spdxElementId": "SPDXRef-Package-go-module-github.com-buildpacks-lifecycle-89c3bd8d4c2e75b7",
96+
"relatedSpdxElement": "SPDXRef-File-launcher-361242815a383bec",
97+
"relationshipType": "OTHER",
98+
"comment": "evident-by: indicates the package's existence is evident by the given file"
99+
},
100+
{
101+
"spdxElementId": "SPDXRef-DocumentRoot-File-launcher",
102+
"relatedSpdxElement": "SPDXRef-Package-go-module-github.com-buildpacks-lifecycle-89c3bd8d4c2e75b7",
103+
"relationshipType": "CONTAINS"
104+
},
105+
{
106+
"spdxElementId": "SPDXRef-DOCUMENT",
107+
"relatedSpdxElement": "SPDXRef-DocumentRoot-File-launcher",
108+
"relationshipType": "DESCRIBES"
109+
}
110+
]
111+
}

0 commit comments

Comments
 (0)