Open jhojczak opened 3 months ago
I wasn't able to reproduce what you are seeing, specifically doing the equivalent of your script yields the same SBOM for me:
❯ tree
.
├── arch-mount
│ ├── md5sum
│ └── sbom.json
└── rocky-mount
├── md5sum
└── sbom.json
3 directories, 4 files
❯ diff arch-mount/md5sum rocky-mount/md5sum
❯ diff arch-mount/sbom.json rocky-mount/sbom.json
I've attached both (identical) SBOMs to this comment below.
arch-sbom.json rocky-sbom.json
I didn't use your script exactly since the real steps it appeared you were trying to get across were (using docker instead):
# from rocky
curl -Lo /tmp/docker-ce-23.0.2-1.el8.x86_64.rpm https://download.docker.com/linux/centos/8/x86_64/stable/Packages/docker-ce-23.0.2-1.el8.x86_64.rpm
mkdir /tmp/rpm
rpm2cpio /tmp/docker-ce-23.0.2-1.el8.x86_64.rpm | cpio -idmv
# ... now there is a populated /tmp/rpm dir
syft dir:/tmp/rpm -o json > /volumemount/rocky.sbom.json
# from the host
docker cp alpinectrid:/tmp/rpm ./rpm
docker cp ./rpm rockyctrid:/tmp
# from alpine
syft dir:/tmp/rpm -o json > /volumemount/alpine.sbom.json
The differences from your script and what I did were:
One of these differences might be a sensitive factor, so I can try and repeat this again and report back.
What happened: Syft does not recognize binary files on archlinux that are recognized on rockylinux even though the contents of the folder are identical.
I have prepared a script that reproduces this behavior.
The script using 'incus' starts two VMs with different Linux distributions (rockylinux and archlinux) and runs syft from a container inside the VMs to scan the folder. The folder contains the unpacked docker-ce rpm package. I decided to unpack the rpm before scanning because the purl/cpe generated by syft from the packed package does not allow finding CVEs assigned to docker. Which in most databases are either assigned to the moby project or to the github/docker/docker repository or prul pkg:rpm/docker repository.
What you expected to happen: Syft should produce the same report from folders containing the same files on both Linux distributions.
Steps to reproduce the issue:
Anything else we need to know?: To run the script, you must have 'incus' or
lxd
installed with the ability to create virtual machines. In the case of lxd, replace the 'incus' command withlxc
in the script. Environment:syft version
:cat /etc/os-release
: