Replies: 1 comment 3 replies
-
|
Hello @gbloquel @knqyf263 wdyt? Can we say that |
Beta Was this translation helpful? Give feedback.
-
|
I don't think so. PURL doesn't use a tag for the version of the oci type. They use a digest as a version. It makes more sense to add a digest in the version field to comply with PURL. |
Beta Was this translation helpful? Give feedback.
-
|
In the link version referenced by @DmitriyLewen we can read I understand your remark but you are talking about |
Beta Was this translation helpful? Give feedback.
-
An image tag is almost free text. It doesn't comply with semver at all. In your case, the image uses the version by chance.
Since SBOM needs some package identifier and Trivy uses PURL, we are trying to get aligned with PURL. |
Beta Was this translation helpful? Give feedback.
-
Description
When I produce a report in CycloneDX for a container Image I expected to have a version in the component Root and the component Root Name contains only the imageName
The command applied is
trivy image --format cyclonedx nginx:1.19If you confirm that is a bug, i can provided a PR.
Desired Behavior
Expected
metadata.component.name=nginxmetadata.component.version=1.19{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ff279ebd-a258-45dc-a4f3-a933759bec41", "version": 1, "metadata": { "timestamp": "2024-07-12T09:26:52 00:00", "tools": { "components": [ { "type": "application", "group": "aquasecurity", "name": "trivy", "version": "dev" } ] }, "component": { "bom-ref": "pkg:oci/nginx@sha256:df13abe416e37eb3db4722840dd479b00ba193ac6606e7902331dcea50f4f1f2?arch=amd64&repository_url=index.docker.io/library/nginx", "type": "container", "name": "nginx", "version": "1.19", "purl": "pkg:oci/nginx@sha256:df13abe416e37eb3db4722840dd479b00ba193ac6606e7902331dcea50f4f1f2?arch=amd64&repository_url=index.docker.io/library/nginx",Actual Behavior
Actual the Name contains Image Name and Version.
metadata.component.name=dockerImage:versionhere
metadata.component.name=nginx:1.19{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f6fc780e-95dd-4e39-8bdb-d8d3f64d502b", "version": 1, "metadata": { "timestamp": "2024-07-12T09:46:07 00:00", "tools": { "components": [ { "type": "application", "group": "aquasecurity", "name": "trivy", "version": "0.53.0" } ] }, "component": { "bom-ref": "pkg:oci/nginx@sha256:df13abe416e37eb3db4722840dd479b00ba193ac6606e7902331dcea50f4f1f2?arch=amd64&repository_url=index.docker.io/library/nginx", "type": "container", "name": "nginx:1.19", "purl": "pkg:oci/nginx@sha256:df13abe416e37eb3db4722840dd479b00ba193ac6606e7902331dcea50f4f1f2?arch=amd64&repository_url=index.docker.io/library/nginx", "properties": [Reproduction Steps
Target
Container Image
Scanner
None
Output Format
CycloneDX
Mode
None
Debug Output
Operating System
Ubuntu 24.04
Version
Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions