Image scan with native application (multiple BOMs attached to OCI image)

[bedla]

Description

Hi, as discussed here #6288 (reply in thread) I am opening this idea.

Use case is following:

• I have GraalVM native build
  • where I lose artifact dependencies information
  • same problem is with other native build eco-systems like C, where I am not able to attach somehow dependencies list like with Go build is done
• Then I have Docker image with dependencies from docker-build
• Now I have two possible SBOMs that might be attached to OCI image
  • First) SBOM of GraalVM build
  • Second) SBOM when scanning Docker image

When I attach both SBOMs to OCI image, currently Trivy takes first one.

I believe that in this case, both SBOMs should be considered for vulnerability scan.

In case of result generated, there should be information from which dependency comes vulnerability (or License violation) detected. If it comes from GraalVM-SBOM or from Image-SBOM or from both.

What do you think?

Thx

Ivos

Note 1: There should not be limitation of how many SBOMs could be attached to OCI image.
Note 2: Workaround might be to merge SBOMs to one (using some CLI tool) and upload/replace current SBOM in the OCI Registry.
Note 3: GraalVM currently in Enterprise edition somehow supports SBOM metadata attached to the binary / but I would not rely on it. See https://www.graalvm.org/latest/reference-manual/native-image/guides/use-sbom-support/

Target

SBOM

Scanner

Vulnerability