aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
https://aquasecurity.github.io/trivy
Apache License 2.0
22.1k stars 2.18k forks source link

fix(sbom): take pkg name from `purl` for maven pkgs #7008

Closed DmitriyLewen closed 1 week ago

DmitriyLewen commented 1 week ago

Description

See #7007

example:

pom.xml:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>example.groupId</groupId>
    <artifactId>example-artifactId</artifactId>
    <version>1.0.0</version>

    <name>example-name</name>
    <description>Example</description>
</project>

before:

➜  trivy -q sbom example.groupId_example-artifactId-1.0.0.spdx.json -f json --list-all-pkgs
{
  ...
  "Results": [
    {
      "Target": "Java",
      "Class": "lang-pkgs",
      "Type": "jar",
      "Packages": [
        {
          "ID": "example-name:1.0.0",
          "Name": "example-name",
          "Identifier": {
            "PURL": "pkg:maven/example.groupId/example-artifactId@1.0.0",
            "UID": "2c55c2ad0ab0ebf"
          },
          "Version": "1.0.0",
          "Licenses": [
            "NOASSERTION"
          ],
          "Layer": {}
        }
      ]
    }
  ]
}

after

➜  ./trivy -q sbom example.groupId_example-artifactId-1.0.0.spdx.json -f json --list-all-pkgs
{
  ...
  "Results": [
    {
      "Target": "Java",
      "Class": "lang-pkgs",
      "Type": "jar",
      "Packages": [
        {
          "ID": "example.groupId:example-artifactId:1.0.0",
          "Name": "example.groupId:example-artifactId",
          "Identifier": {
            "PURL": "pkg:maven/example.groupId/example-artifactId@1.0.0",
            "UID": "602ee3f42c8bc4ec"
          },
          "Version": "1.0.0",
          "Licenses": [
            "NOASSERTION"
          ],
          "Layer": {}
        }
      ]
    }
  ]
}

Related issues

Checklist