Image scan with native application

[bedla]

Description

Hi,
I want to know you opinion about following use-case.

Let's have following use-case:

• Java/Kotlin application build with GraalVM AOT Native build (.jar libs are baked into executable)
• Application is distributed as Docker Image
• SBOM is generated and saved into for example Artifactory

If I understand correctly current behavior of Trivy:

• baked .jar libs are not scanned because Trivy does not know about them
• Only artifacts in Image itself are scanned
• There is no way how to tell Trivy to also use SBOM (I saw remote-sbom config, but it is something different - I guess)

What do you think?

Thx

Ivos

Target

Container Image

Scanner

Vulnerability

[bedla]

Note this applies alto to any other Native build, like Go, C, etc.

[itaysk]

please see here: https://aquasecurity.github.io/trivy/v0.52/docs/target/container_image/#discovery

[bedla]

I see, thank you for answer.

(I will experiment with it now)

[bedla]

If I understand it correctly, I need to know in advance if there is SBOM in Referrers or not, right?

[itaysk]

you can enable the SBOM discovery always, if there's no SBOM in the registry the scan will proceed as usual

[bedla]

cool thank you

[bedla]

Hi Itay,
I am playing with latest Trivy (current master branch after v0.55.1 release) and Harbor v2.11.1-6b7ecba1 and found (also checked from source-code) that first SBOM is taken into account.

Let's assume following scenario:

• I have SBOM-1 generated from my src-repo
• I create native build using GraalVM and get Docker image
• I scan Docker image with Trivy to generate SBOM-2 (it contains only libs from image itself, not from src-repo's pom.xml)
• I attach both SBOMs to Image, check oras output

$ oras discover --verbose localhost:8888/my-project/demo:0.0.1-SNAPSHOT

localhost:8888/my-project/demo@sha256:ff587db7f89f4c3c57928c81a352f50a79594302782e7d00e8074095ea9da51b
├── application/vnd.goharbor.harbor.sbom.v1
│   └── sha256:2d16d760ce36f457b2130206915e108f4c2c9c3e859a3a66cdc44f3333b5d240
│       ├── org.opencontainers.artifact.created: "2024-09-14T15:44:10Z"
│       ├── org.opencontainers.artifact.description: SPDX JSON SBOM
│       ├── created: "2024-09-14T15:44:10Z"
│       └── created-by: Harbor
├── doc/example
│   ├── sha256:0433ca1014251385c8181daeeeeb615a5e0d6ced81d67ba1537187cffc3f4636
│   │   └── org.opencontainers.image.created: "2024-09-14T16:22:55Z"
│   └── sha256:ca3a31afcec308700259ecfb730881b6476311ae5a5d6910e4c110cd16b60409
│       ├── created-by: Ivos
│       └── org.opencontainers.image.created: "2024-09-14T16:24:07Z"
└── application/vnd.cyclonedx+json
    ├── sha256:16e05f8568bcd1b20cb9067132a595890cbda224ba7d6a13cec091d02577a8b6
    │   ├── created-by: Ivos
    │   └── org.opencontainers.image.created: "2024-09-14T16:27:59Z"
    └── sha256:910ca47ac86b846b6a0ce8f3aeb44db6f1a17dcd414263453a9c29cac76deb67
        ├── created-by: Ivos
        └── org.opencontainers.image.created: "2024-09-14T16:41:16Z"

• Only first application/vnd.cyclonedx+json is taken into account.
• Also question is which one is first one created annotation is optional

Note: Also mind that Harbor has functionality to generate SBOM from Image and attach it as application/vnd.goharbor.harbor.sbom.v1 in SPDX format (I am not sure if it can be considered as stable API).

When I have multiple sources of SBOMs, in case native-build, I have two options:

1. Merge SBOMs together eg. using cyclonedx-cli tool (currently it does not support v1.6, but it seems they will fix it soon, see Support for CycloneDX schema version 1.6 CycloneDX/cyclonedx-cli#375 (comment) )
2. Let Trivy to discover all of supported SBOMs attached to Image and do the scan (currently not implemented, I might try to send PR after investigation how hard it would be)

What do you think?

Thank you

Ivos

[itaysk]

first SBOM is taken into account

Yes, this is by design. Trivy assumes multiple SBOMs are iterations on the same code (therefore only the latest is taken), and not complimentary to each other.

which one is first one created annotation is optional

Trivy looks at the referrers in the registry and picks the first one that looks like a valid SBOM:
https://github.com/aquasecurity/trivy/blob/04a854c3373952cc555bb4c2877d7cb0c4eb8335/pkg/fanal/artifact/image/remote_sbom.go#L71:L82

This is the current behavior, but I do think you raise a valid discussion, since all SBOMs that describe the same image digest are valid data points.

cc: @knqyf263

[knqyf263]

Yes, you can open a new discussion on how Trivy chooses one SBOM among multiple SBOMs or other ideas. Currently, it is a simple implementation that only gets the first one, as @itaysk said.