Replies: 4 comments 2 replies
-
|
@DmitriyLewen Could you take a look when you have time? |
Beta Was this translation helpful? Give feedback.
-
|
Hello @obormot
This is a bit of an odd use of group field. But i didn't see that Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
We use the group field to point at Python virtualenvs (same package may appear in multiple venvs). I don't think this affects the issue in question. |
Beta Was this translation helpful? Give feedback.
-
|
CycloneDX docs say: Usually group is part of package name. I'm not sure if your logic is using
We merge Lines 250 to 255 in 13e72ec In your case: ➜ 6461 trivy -q sbom ./test.cdx.json -f json --list-all-pkgs | grep '"Name"'
"Name": "/usr/share/python/xyz/setuptools",I also checked CycloneDX Python repo and didn't find |
Beta Was this translation helpful? Give feedback.
-
|
Experimented with this a bit. Basically having any group name (with forward slash characters or without) breaks things in Trivy 0.50.0. |
Beta Was this translation helpful? Give feedback.
-
I think CycloneDX doesn't mean dependencies grouping. I think in this case they mean the equivalent of In any case, let's wait for users feedback. If many people use similar logic - we will exclude Python from decoding the |
Beta Was this translation helpful? Give feedback.
-
Description
A CycloneDX 1.4 spec JSON SBOM file generated outside of Trivy, worked well with 0.49.1 and prior, and is now broken staring with 0.50.0 (zero vulnerabilities returned). Debug output shows sbom parsing errors
Skipping a component with an unsupported type {"name": "/usr/share/python/xyz", "version": "", "type": ""}while thetypeis actually set tolibrary.Desired Behavior
Behavior should be consistent with trivy 0.49.1 shown below.
Actual Behavior
Parsing errors resulting in zero vulnerabilities reported against a SBOM.
Reproduction Steps
python-sbom-poc.json: { "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:5513ff22-229d-4009-a3d6-d91b93cb58b6", "version": 1, "metadata": { "timestamp": "2023-12-15T16:50:45.593021000Z", "component": { "bom-ref": "214539e6-ab03-4893-907d-10283bf2da55", "type": "application", "name": "Python packages" } }, "components": [ { "name": "setuptools", "type": "library", "version": "58.4.0", "purl": "pkg:pypi/setuptools@58.4.0", "bom-ref": "setuptools@/usr/share/python/xyz", "group": "/usr/share/python/xyz", "externalReferences": [ { "url": "https://github.com/pypa/setuptools", "type": "website" } ] }, { "bom-ref": "ef6ac325-3958-4984-8158-c1f861cd88a4", "type": "application", "name": "/usr/share/python/xyz" } ], "dependencies": [ { "ref": "ef6ac325-3958-4984-8158-c1f861cd88a4", "dependsOn": [ "setuptools@/usr/share/python/xyz" ] }, { "ref": "214539e6-ab03-4893-907d-10283bf2da55", "dependsOn": [ "ef6ac325-3958-4984-8158-c1f861cd88a4" ] } ] }Target
SBOM
Scanner
Vulnerability
Output Format
Table
Mode
Standalone
Debug Output
Operating System
Ubuntu focal
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions