Open marinedayo opened 4 months ago
Thanks for the report @marinedayo -- I can confirm this on the latest Syft, 1.5.0, even with the base rockylinux:9
, binary packages detected:
$ syft rockylinux:9 --select-catalogers binary -q | grep binary
bash 5.1.8 binary
openssl 3.0.7 binary
python 3.9.18 binary
... but none included with the aforementioned option:
$ SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP=false syft rockylinux:9 -q | grep binary
Thanks for the reply.
As you mentioned, other binaries are also installed with RPM packages in Rocky Linux, so it's the same thing.
Syft v1.5.0:
$ syft rockylinux:9 -q | grep binary
$ SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP=false syft rockylinux:9 -q | grep binary
Syft v1.3.0:
$ syft rockylinux:9 -q | grep binary
$ SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP=false syft rockylinux:9 -q | grep binary
bash 5.1.8 binary
openssl 3.0.7 binary
python 3.9.18 binary
Looks like it is affected by this commit https://github.com/anchore/syft/commit/4194a2cd34d2f15dd9a96774ba2fbc5463db4c58 in v1.4.0.
Since bash
binary package is bash as an executable file, while bash
RPM package is bash as an RPM package (i.e. it contains files other than the executable bash), in my case I would prefer not to remove it.
I suggest a configuration like SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP
that skips this process.
What happened:
SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP=false
is not working in Syft v1.4.0 or later.I am using Syft with
SYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP=false
to outputjava
installed via RPM package as CycloneDX component typeapplication
. But it is not working. None ofapplication
type is output.It works fine when using Syft v1.3.0.
What you expected to happen:
Expect
java
andnode
, etc. installed via RPM package to be output as CycloneDX component typeapplication
.Steps to reproduce the issue:
For example, prepare the following container image named
myapp:latest
:Execute
syft
withSYFT_PACKAGE_EXCLUDE_BINARY_OVERLAP_BY_OWNERSHIP=false
:None of
application
type is output:Anything else we need to know?:
When it is
binary
, it becomesapplication
in CycloneDX format. https://github.com/anchore/syft/blob/v1.5.0/syft/format/internal/cyclonedxutil/helpers/component.go#L39-L42Environment: