[docker] Test SBOM generation for an image with a crypto miner

[prabhu]

https://apogliaghi.com/2025/09/crypto-miner-in-hotio/qbittorrent/

ghcr.io/hotio/qbittorrent@sha256:3779f89712dbaa8b25fc22897d0b471ee29049b2b0f8d3c192df83b098c84fc5

[prabhu]

As expected, cdxgen didn't detect the crypto-miner binary.

bom-qbittorrent.json

This is because the miner is downloaded as the second stage from the binaries qbittorrent-nox-lib1 and qbittorrent-nox-lib2.

blint, however, detects it as a loader correctly 😎

blint -i .                                                                                                                                                                                                                                       

██████╗ ██╗     ██╗███╗   ██╗████████╗
██╔══██╗██║     ██║████╗  ██║╚══██╔══╝
██████╔╝██║     ██║██╔██╗ ██║   ██║
██╔══██╗██║     ██║██║╚██╗██║   ██║
██████╔╝███████╗██║██║ ╚████║   ██║
╚═════╝ ╚══════╝╚═╝╚═╝  ╚═══╝   ╚═╝

                                                      BLint Findings
╔════════════════════╤═════════════════════════════════════════════════════════╤══════════════════════════════╤══════════╗
║ ID                 │ Binary                                                  │ Title                        │ Severity ║
╟────────────────────┼─────────────────────────────────────────────────────────┼──────────────────────────────┼──────────╢
║ CHECK_VIRTUAL_SIZE │ /Users/prabhu/foo/blobs/sha256/app/qbittorrent-nox-lib2 │ Optimize binary virtual size │ MEDIUM   ║
╟────────────────────┼─────────────────────────────────────────────────────────┼──────────────────────────────┼──────────╢
║ CHECK_VIRTUAL_SIZE │ /Users/prabhu/foo/blobs/sha256/app/qbittorrent-nox-lib1 │ Optimize binary virtual size │ MEDIUM   ║
╟────────────────────┼─────────────────────────────────────────────────────────┼──────────────────────────────┼──────────╢
║ CHECK_VIRTUAL_SIZE │ ./qbittorrent-nox-lib2                                  │ Optimize binary virtual size │ MEDIUM   ║
╟────────────────────┼─────────────────────────────────────────────────────────┼──────────────────────────────┼──────────╢
║ CHECK_VIRTUAL_SIZE │ ./qbittorrent-nox-lib1                                  │ Optimize binary virtual size │ MEDIUM   ║
╚════════════════════╧═════════════════════════════════════════════════════════╧══════════════════════════════╧══════════╝
           INFO     Findings written to /Users/prabhu/foo/blobs/sha256/app/reports/findings.json
                                                BLint Capability Review
╔════════════════╤═════════════════════════════════════════════════════════╤═══════════════════════╤══════════════════╗
║ ID             │ Binary                                                  │ Capabilities          │ Evidence (Top 5) ║
╟────────────────┼─────────────────────────────────────────────────────────┼───────────────────────┼──────────────────╢
║ LOADER_SYMBOLS │ /Users/prabhu/foo/blobs/sha256/app/qbittorrent-nox-lib2 │ Behaves like a loader │ /proc/self/exe   ║
║                │                                                         │                       │ /etc/resolv.conf ║
╟────────────────┼─────────────────────────────────────────────────────────┼───────────────────────┼──────────────────╢
║ LOADER_SYMBOLS │ /Users/prabhu/foo/blobs/sha256/app/qbittorrent-nox-lib1 │ Behaves like a loader │ /proc/self/exe   ║
║                │                                                         │                       │ /etc/resolv.conf ║
╟────────────────┼─────────────────────────────────────────────────────────┼───────────────────────┼──────────────────╢
║ LOADER_SYMBOLS │ ./qbittorrent-nox-lib2                                  │ Behaves like a loader │ /proc/self/exe   ║
║                │                                                         │                       │ /etc/resolv.conf ║
╟────────────────┼─────────────────────────────────────────────────────────┼───────────────────────┼──────────────────╢
║ LOADER_SYMBOLS │ ./qbittorrent-nox-lib1                                  │ Behaves like a loader │ /proc/self/exe   ║
║                │                                                         │                       │ /etc/resolv.conf ║
╚════════════════╧═════════════════════════════════════════════════════════╧═══════════════════════╧══════════════════╝
           INFO     Reviews written to /Users/prabhu/foo/blobs/sha256/app/reports/reviews.json
           INFO     HTML report written to /Users/prabhu/foo/blobs/sha256/app/reports/blint-output.html

Invoking blint for every binary seen by cdxgen could be an option (for those willing to wait).