scan image with --list-all-pkgs flag has missing os installed files with in the report

[chen-keinan]

when running a simple scan:

trivy image nginx --list-all-pkgs --format json

OS packages installed files are detected from each layer and apply it to map

Each layer has different installed files on packages.
Since the map key is the same var/lib/dpkg/status/type:ospkg for os packages then it get overwritten by the different layers

[knqyf263]

I'm still debugging this issue, but it looks like the installed files need to be handled similarly to licenses since dpkg has separate files for installed files, unlike apk and rpm.

trivy/pkg/fanal/applier/docker.go

Lines 187 to 206 in 1f0d629

	// Extract dpkg licenses
	// The license information is not stored in the dpkg database and in a separate file,
	// so we have to merge the license information into the package.
	dpkgLicenses := make(map[string][]string)
	mergedLayer.Licenses = lo.Reject(mergedLayer.Licenses, func(license ftypes.LicenseFile, _ int) bool {
	if license.Type != ftypes.LicenseTypeDpkg {
	return false
	}
	// e.g.
	// "adduser" => {"GPL-2"}
	// "openssl" => {"MIT", "BSD"}
	dpkgLicenses[license.PkgName] = lo.Map(license.Findings, func(finding ftypes.LicenseFinding, _ int) string {
	return finding.Name
	})
	// Remove this license in the merged result as it is merged into the package information.
	return true
	})
	if len(mergedLayer.Licenses) == 0 {
	mergedLayer.Licenses = nil
	}

[knqyf263]

I'm sorry I forgot to look into it.
@DmitriyLewen Could you take a look?

[DmitriyLewen]

@knqyf263 I have researched this problem and have not found better solution than the one you suggested.
I created #6682 with a fix.

[knqyf263]

@DmitriyLewen Do you think we can polish the existing PR from Chen? Or should we create a new PR?

[DmitriyLewen]

Chen and my PR are different.
Chen updated analyzers for Node package and Python packaging (though I didn’t understand why).
I also used different logic for applier (I created common map similar to the one for secrets).
Therefore, it was easier for me to create new PR.