Open willmurphyscode opened 1 month ago
Is there another way to scan these artifacts? Are these container images in some differing format from OCI? If the only way to identify what is installed is by scanning an SBOM, there could probably just be a Bitnami cataloger that looks for specific SBOMs in these known bitnami locations, instead of enabling the SBOM cataloger itself. It's pretty easy to just pass a reader to the SBOM decoder. And then we'd probably want to have a way to prevent SBOMs from getting scanned twice if a user does enable the SBOM cataloger.
Two questions for investigation:
The easy path to implement this is essentially a copy of the SBOM cataloger with a much narrower file glob, assuming it doesn't cause duplicates or miss critical information.
What would you like to be added:
As part of anchore/grype#1609, Syft should pick up on sboms in containers located at
/opt/bitnami
because this is how Bitnami records what's in an image.The SBOM cataloger would probably do this already, but is off by default.
There are a few open questions here:
FROM
a Bitnami image? How do we know we can trust the SBOM?Why is this needed:
This is primarily needed so that running
grype
on a Bitnami image (see anchore/grype#1609) is as accurate as possible.Additional context:
There are a few open requests for more accurate Bitnami classification. Ideally this work might also fix those.