Empty component name when creating sbom from image created with bootBuildImage

[glennvdv]

Description

When creating an sbom of a docker image created with the command bootBuildImage. Trivy generates a component with an empty name.

Desired Behavior

Or component should not be present, or name should be filled in

Actual Behavior

name is missing

Reproduction Steps

- generate spring boot project (https://start.spring.io/)
- run gradlew bootbuildImage
- run trivy image --format cyclonedx --output result.json IMAGE_NAME
Result file will contain something like this:
`    {
      "bom-ref": "f943ec78-bad5-4f04-99e7-2dcb106c6d85",
      "type": "application",
      "name": "",
      "properties": [
        {
          "name": "aquasecurity:trivy:Class",
          "value": "lang-pkgs"
        },
        {
          "name": "aquasecurity:trivy:Type",
          "value": "gobinary"
        }
      ]
    }`

Target

Container Image

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Debug Output

2024-09-19T13:36:50+02:00       DEBUG   No plugins loaded
2024-09-19T13:36:50+02:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-09-19T13:36:50+02:00       DEBUG   Cache dir       dir="/home/gv/.cache/trivy"
2024-09-19T13:36:50+02:00       DEBUG   Cache dir       dir="/home/gv/.cache/trivy"
2024-09-19T13:36:50+02:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-09-19T13:36:50+02:00       DEBUG   Ignore statuses statuses=[]
2024-09-19T13:36:50+02:00       INFO    "--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "cyclonedx" report.
2024-09-19T13:36:50+02:00       DEBUG   [pkg] Package types     types=[os library]
2024-09-19T13:36:50+02:00       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-09-19T13:36:50+02:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-09-19T13:36:50+02:00       DEBUG   Initializing scan cache...      type="fs"
2024-09-19T13:36:50+02:00       DEBUG   [image] Detected image ID       image_id="sha256:200e61309d3011bc0375d987b1610c61dcf87b0a59f4706defacaec5369db7d1"
2024-09-19T13:36:50+02:00       DEBUG   [image] Detected diff ID        diff_ids=[sha256:2573e0d8158209ed54ab25c87bcdcb00bd3d2539246960a3d592a1c599d70465 sha256:dfb662718104dfd7cf5b4894852d38b3dcc03ffd49e5c8b4a53e865b8154cdfd sha256:23fda1eb5bae018b1fb66118776fa7eb411610e591117db7929429460f65f7ac sha256:7cc16eb89e7d7c60c10030ea4f0299c03f8e28699fa54fbebb8c366741489213 sha256:343c6290b0f2ed03d2e417d111ed5db6e41914e338d83a45f73744d16899423f sha256:cb7c0abe7568a96bc898f79ddb15b400abb1c80f79f7b1361c2a9d183e53834f sha256:bea0a3dc2651cac7c9c567a5cb4e7536107b357cb9113e8806f690f050500012 sha256:3b37488d9a9c7539f69814901831aeef1c71777943180ffd1b14baf54345c4a4 sha256:417e5bfc3c82b9373cf6804206e071d2fc74560df867d0f39cb21ac3d15231b6 sha256:c6902f46e4f8c572b0ce611b53b2c8d0e5dcea7e3d35e41b8077619d31cef236 sha256:ce4e86e0307e01ceb95d3abacfa3e157fb781571d00e698faccf6fe91ccd83ee sha256:366ce7d1a7f90f2e4ad08752f87510eee3ffca18736fa63c03823c8c4ebf2925 sha256:8eb7d03527eed8a90ed088cc355e7c0e517118a31254c17d605f81862a92adf2 sha256:cca8781b24a9f6fad09dde178aa7f8559a5329e3c7dc19cc08f42ca47d0fca6d sha256:62b97a790014986d27ed578499435a06a269cc0a8894f3be4f32a8dd7806e2d2 sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef sha256:2257accaed4d6f1a6d11123af1ff5263787c0ade31f630a867976912a0ebdf94 sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef sha256:d877b693c335c5715d181ddb4c835af43cd48418f1edf4f7657eff8e24f8e4b9 sha256:f3e6835448298a6dcb929ee8a7f26c70b5693867cdc5807d4e3e5a1097d50b32 sha256:1dc94a70dbaa2171fb086500a5d27797f779219b126b0a1eebb9180c2792e80e]
2024-09-19T13:36:50+02:00       DEBUG   [image] Detected base layers    diff_ids=[]
2024-09-19T13:36:50+02:00       INFO    Detected OS     family="ubuntu" version="22.04"
2024-09-19T13:36:50+02:00       INFO    Number of language-specific files       num=6
2024-09-19T13:36:50+02:00       DEBUG   [vex] VEX filtering is disabled

Operating System

linux

Version

Version: 0.55.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-19 06:12:22.986098678 +0000 UTC
  NextUpdate: 2024-09-19 12:12:22.986098548 +0000 UTC
  DownloadedAt: 2024-09-19 06:41:53.411191991 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-09-17 01:05:13.063235569 +0000 UTC
  NextUpdate: 2024-09-20 01:05:13.063235449 +0000 UTC
  DownloadedAt: 2024-09-18 07:51:07.579646002 +0000 UTC
Check Bundle:
  Digest: sha256:ef2d9ad4fce0f933b20a662004d7e55bf200987c180e7f2cd531af631f408bb3
  DownloadedAt: 2024-09-18 09:28:51.515067159 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @glennvdv

Reproduction Steps

I couldn't build the image. It looks like the system needs some configuration.

We are focusing on other priorities.
It would be great if you could upload this test image to DockerHub.
It will help and speed up the investigation of this issue.

Regards, Dmitriy

[glennvdv]

What error are you getting? Only java & docker are needed to be able to build it

[DmitriyLewen]

...
    [creator]         Using Java version 23 extracted from MANIFEST.MF
    [creator]       No valid JRE available, providing matching JDK instead. Using a JDK at runtime has security implications.
    [creator]        : Contributing to layer
    [creator]       Warning: Dependency has no SHA256. Skipping cache.
    [creator]         Downloading from 
    [creator]     unable to invoke layer creator
    [creator]     unable to get dependency . see DEBUG log level
    [creator]     ERROR: failed to build: exit status 1

> Task :bootBuildImage FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':bootBuildImage'.
> Builder lifecycle 'creator' failed with status code 51

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

BUILD FAILED in 1m
5 actionable tasks: 5 executed

[glennvdv]

pushed to https://hub.docker.com/repository/docker/stuikerd/vulnerable-spring-boot/general
you can execute command
trivy image --format cyclonedx --output result.json stuikerd/vulnerable-spring-boot:latest
You will find following entry:
{ "bom-ref": "8447fd4c-af4b-4d88-a392-84896a774682", "type": "application", "name": "", "properties": [ { "name": "aquasecurity:trivy:Class", "value": "lang-pkgs" }, { "name": "aquasecurity:trivy:Type", "value": "gobinary" } ] }

[DmitriyLewen]

Hello @glennvdv

I investigated this case.

This image contains layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json file.

This file doesn't have application component (SPDX format doesn't have strict restrictions in some points).

So Trivy detects only libraries, but can't correctly determinate filepath for application target.

[glennvdv]

Should this than be skipped or what should the correct behavior be?

[DmitriyLewen]

it is hard to say which behavior is correct.
The SPDX format doesn't have strict rules in some points, so we cannot foresee all possible cases.
But we always try to use the same structure for all Trivy reports (that is why we can't skip this component).
In this case, we cannot correctly determine which file path to use - so we leave this field empty.

[DmitriyLewen]

User found 1 more case with same problem - #8287.

This problem is aggravated by the fact that for such sbom files we create a spdx file with an empty name field (and this is not a valid file(#8287)

therefore we need to make some decision regarding such situations (fixes are needed in the sbom analyzer).

I see 2 ways:

• use a hash of the component structure or just uuid
• use the path to the sbom file. but this can cause confusion if we use the name of the sbom file and the name from the component for several components of one sbom)

@knqyf263 wdyt?

[DmitriyLewen]

Yes, that's what the original SBOM describes. Shouldn't we keep it?

This will not be the original SBOM.

Take a look at the SBOM from my example.
This SBOM shows Application, but Trivy can't "read" it.
So we need to add all the unreadable (for Trivy) components (e.,g. SPDXRef-DocumentRoot-File-launcher). Otherwise we will get a non-original SBOM.

Or am i missing something?

[knqyf263]

This SBOM shows Application, but Trivy can't "read" it.

Ah, I get your point now. I was not following what you were talking about. The root cause is that Trivy cannot identify the application component from third-party SBOMs.
Anyway, is it problematic if we flatten the packages in the SBOMs? The application component we inject is pseudo. I'm not sure if it helps users understand. Then, isn't it simpler to flatten them and add PackageSourceInfo to clarify those packages come from SBOM?

[DmitriyLewen]

PackageSourceInfo to clarify those packages come from SBOM?

Do you want to add PackageSourceInfo as property, right?

The application component we inject is pseudo. I'm not sure if it helps users understand. Then, isn't it simpler to flatten them

Pseudo application is more logical for me. But perhaps I'm just accustomed to this logic.

One question I see from users we'll get is why for the same types Trivy may or may not include an app component?.

For me it's better to use the same structure for all cases.
It's also easier for users to understand why reports include different filePaths rather than different component chains (root->app->pkg vs root->pkg).

but like I said - that might just be my habit.

[knqyf263]

Do you want to add PackageSourceInfo as property, right?

Sorry I was talking about SPDX. Doesn't CycloneDX have a similar field?

Pseudo application is more logical for me.

OK, we anyway need a short-term fix since Trivy is currently generating invalid SBOMs. If injecting pseudo applications is the easiest way, it's good to go for it at the moment.

[DmitriyLewen]

Doesn't CycloneDX have a similar field?

I don't see a suitable field. So I would use properties.

OK, we anyway need a short-term fix since Trivy is currently generating invalid SBOMs. If injecting pseudo applications is the easiest way, it's good to go for it at the moment.

#8346

[DmitriyLewen]

Related issue - #8189