Docker Image scan via synopsys/blackduck

[Martin-Stach]

Hi all,

i am not sure if here is the right place to ask, but i have to try and start somewhere.
I tired to scan with blackduck (OSS license scanner the cerbos docker image ghcr.io/cerbos/cerbos:0.28.0 but the scanner output is only ca-certificates-bundle where as when i scan just the default ubuntu container i see all the content of the container.
What am i doing wrong? Can someone help me? Sorry if that is a stupid questino.

Thanks in advance

[charithe]

Hi. Cerbos container is a minimal scratch container and does not contain an OS. It would only contain the statically compiled Cerbos binary and the CA root certificates.

I am not familiar with BlackDuck software. If you're looking for the list of dependencies of Cerbos, go to the relevant release tag on the Cerbos GitHub repo and examine the NOTICE.txt file. It contains a full list of dependencies and their licences. Here's the one for v0.29.0 which was released today: https://github.com/cerbos/cerbos/blob/v0.29.0/NOTICE.txt

[Martin-Stach]

Yes the goal of the scan is scanning the dependencies of cerbos. But if the txt file is the only way of getting it, i have to think of something else.
Thanks for the quick reply!

[charithe]

Trivy is capable of scanning the image and producing a list of dependencies.

trivy image --list-all-pkgs --format=json ghcr.io/cerbos/cerbos:0.29.0

All the binaries and sources are available on GitHub releases as well so if your scanning software has support for any of those, you could obtain the list that way too.