SBOMs do not contain docker image metadata #2608
Labels
Comments
2 tasks
lucasrod16
pushed a commit
that referenced
this issue
Jun 11, 2024
## Description
When creating an image SBOM with syft, we currently pass an empty string
`""` to `NewFromStereoscopeImageObject` when creating a new image source
object.
```go
source.NewFromStereoscopeImageObject(syftImage, "", nil)
```
The second argument is the image reference. This data is ultimately used
to populate the source metadata in the final SBOM, but since we pass an
empty string, the `userInput` field is empty.
The fix is to pass in the image reference so that the `userInput` field
is populated in the final SBOM.
```go
source.NewFromStereoscopeImageObject(syftImage, ref, nil)
```
Steps to reproduce:
1. Create this package
```yaml
kind: ZarfPackageConfig
metadata:
name: sbom-test
architecture: amd64
components:
- name: sbom-test
required: true
images:
- quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z
```
1. Extract the package
```shell
zarf tools archiver decompress zarf-package-sbom-test-amd64.tar.zst sbom
```
1. Extract the sbom tarball
```shell
zarf tools archiver decompress sbom/sboms.tar sbom/syft
```
1. Check the `.source.metadata.userInput` field in the image SBOM
```shell
cat sbom/syft/quay.io_minio_minio_RELEASE.2024-03-21T23-13-43Z.json | jq
.source.metadata.userInput
```
With current Zarf, you will see that it returns an empty string. Re-run
all of the above steps with Zarf built from this PR branch, and you will
see it returns the image reference
`quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z`
1. Generate a vulnerability scan report with `grype`
```shell
cat sbom/syft/quay.io_minio_minio_RELEASE.2024-03-21T23-13-43Z.json |
grype -o sarif > zarf-scan.json
```
You will see that the generated report is missing the image reference in
the output
`"text": "A medium vulnerability in go-module package:
gopkg.in/square/go-jose.v2, version v2.6.0 was found in image at:
/usr/bin/minio"`
Re-run all of the above steps with Zarf built from this PR branch, and
you will see the image reference in the generated report:
`"text": "A medium vulnerability in go-module package:
gopkg.in/square/go-jose.v2, version v2.6.0 was found in image
quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z at: /usr/bin/minio"`
## Related Issue
Fixes #2608
## Checklist before merging
- [x] Test, docs, adr added or updated as needed
- [x] [Contributor Guide
Steps](https://github.com/defenseunicorns/zarf/blob/main/.github/CONTRIBUTING.md#developer-workflow)
followed
AustinAbro321
pushed a commit
that referenced
this issue
Jul 23, 2024
## Description
When creating an image SBOM with syft, we currently pass an empty string
`""` to `NewFromStereoscopeImageObject` when creating a new image source
object.
```go
source.NewFromStereoscopeImageObject(syftImage, "", nil)
```
The second argument is the image reference. This data is ultimately used
to populate the source metadata in the final SBOM, but since we pass an
empty string, the `userInput` field is empty.
The fix is to pass in the image reference so that the `userInput` field
is populated in the final SBOM.
```go
source.NewFromStereoscopeImageObject(syftImage, ref, nil)
```
Steps to reproduce:
1. Create this package
```yaml
kind: ZarfPackageConfig
metadata:
name: sbom-test
architecture: amd64
components:
- name: sbom-test
required: true
images:
- quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z
```
1. Extract the package
```shell
zarf tools archiver decompress zarf-package-sbom-test-amd64.tar.zst sbom
```
1. Extract the sbom tarball
```shell
zarf tools archiver decompress sbom/sboms.tar sbom/syft
```
1. Check the `.source.metadata.userInput` field in the image SBOM
```shell
cat sbom/syft/quay.io_minio_minio_RELEASE.2024-03-21T23-13-43Z.json | jq
.source.metadata.userInput
```
With current Zarf, you will see that it returns an empty string. Re-run
all of the above steps with Zarf built from this PR branch, and you will
see it returns the image reference
`quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z`
1. Generate a vulnerability scan report with `grype`
```shell
cat sbom/syft/quay.io_minio_minio_RELEASE.2024-03-21T23-13-43Z.json |
grype -o sarif > zarf-scan.json
```
You will see that the generated report is missing the image reference in
the output
`"text": "A medium vulnerability in go-module package:
gopkg.in/square/go-jose.v2, version v2.6.0 was found in image at:
/usr/bin/minio"`
Re-run all of the above steps with Zarf built from this PR branch, and
you will see the image reference in the generated report:
`"text": "A medium vulnerability in go-module package:
gopkg.in/square/go-jose.v2, version v2.6.0 was found in image
quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z at: /usr/bin/minio"`
## Related Issue
Fixes #2608
## Checklist before merging
- [x] Test, docs, adr added or updated as needed
- [x] [Contributor Guide
Steps](https://github.com/defenseunicorns/zarf/blob/main/.github/CONTRIBUTING.md#developer-workflow)
followed
Signed-off-by: Austin Abro <AustinAbro321@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Steps to reproduce
I have an interesting issue with the sboms created from zarf…
When you perform this action against a docker container:
syft quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z -o syft | grype -o sarifThe output has the name of the container in it:
"text": "A medium vulnerability in go-module package: gopkg.in/square/go-jose.v2, version v2.6.0 was found in image quay.io/minio/minio:RELEASE.2024-03-21T23-13-43Z at: /usr/bin/minio"However, if you put the image in a zarf package, then take the zarf generated sbom (via syft) and run it through grype:
grype quay.io_minio_minio_RELEASE.2024-03-21T23-13-43Z.json -o sarifIt does not contain the image name:
"text": "A medium vulnerability in go-module package: gopkg.in/square/go-jose.v2, version v2.6.0 was found in image at: /usr/bin/minio"When you compare the syft documents, you realise that the whole source block is missing, so theres no image metadata in the file under the source key.
I think this is because zarf generates the sbom from the OCI image, and i presume when zarf pulls the docker image and converts it to an oci image, it strips all the image metadata?
This makes the sarif output kinda useless in grype as i cant then upload it to github advanced security. When you upload it, it you cant see which the vulnerability is coming from… Just the binary.
Severity/Priority
Additional Context
Add any other context or screenshots about the technical debt here.
The text was updated successfully, but these errors were encountered: