fix(sbom): detect main OS and ignore pkgs for other OSes

integration/sbom_test.go

@@ -20,6 +20,7 @@ func TestSBOM(t *testing.T) {
 		format       string
 		artifactType string
 		scanners     string
+		listAllPkgs  bool
 	}
 	tests := []struct {
 		name     string
@@ -101,6 +102,11 @@ func TestSBOM(t *testing.T) {
 
 				require.Len(t, got.Results, 1)
 				want.Results[0].Target = "testdata/fixtures/sbom/centos-7-spdx.txt (centos 7.6.1810)"
+
+				require.Len(t, got.Results[0].Vulnerabilities, 3)
+				want.Results[0].Vulnerabilities[0].PkgIdentifier.BOMRef = "Package-5a18334f22149877"
+				want.Results[0].Vulnerabilities[1].PkgIdentifier.BOMRef = "Package-e16b1cbaa5186199"
+				want.Results[0].Vulnerabilities[2].PkgIdentifier.BOMRef = "Package-e16b1cbaa5186199"
 			},
 		},
 		{
@@ -117,6 +123,11 @@ func TestSBOM(t *testing.T) {
 
 				require.Len(t, got.Results, 1)
 				want.Results[0].Target = "testdata/fixtures/sbom/centos-7-spdx.json (centos 7.6.1810)"
+
+				require.Len(t, got.Results[0].Vulnerabilities, 3)
+				want.Results[0].Vulnerabilities[0].PkgIdentifier.BOMRef = "Package-5a18334f22149877"
+				want.Results[0].Vulnerabilities[1].PkgIdentifier.BOMRef = "Package-e16b1cbaa5186199"
+				want.Results[0].Vulnerabilities[2].PkgIdentifier.BOMRef = "Package-e16b1cbaa5186199"
 			},
 		},
 		{
@@ -129,6 +140,16 @@ func TestSBOM(t *testing.T) {
 			},
 			golden: "testdata/license-cyclonedx.json.golden",
 		},
+		{
+			name: "multiple OSes",
+			args: args{
+				input:        "testdata/fixtures/sbom/multiple-os.sdpx.json",
+				format:       "json",
+				artifactType: "spdx",
+				listAllPkgs:  true,
+			},
+			golden: "testdata/multiple-os.json.golden",
+		},
 	}
 
 	// Set up testing DB
@@ -162,6 +183,10 @@ func TestSBOM(t *testing.T) {
 			osArgs = append(osArgs, "--output", outputFile)
 			osArgs = append(osArgs, tt.args.input)
 
+			if tt.args.listAllPkgs {
+				osArgs = append(osArgs, "--list-all-pkgs")
+			}
+
 			// Run "trivy sbom"
 			runTest(t, osArgs, tt.golden, outputFile, types.Format(tt.args.format), runOptions{
 				override: overrideFuncs(overrideSBOMReport, overrideUID, tt.override),

integration/testdata/fixtures/sbom/multiple-os.sdpx.json

@@ -0,0 +1,116 @@
+{
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2024-06-10T14:07:15Z",
+    "creators": [
+      "Organization: foo",
+      "Tool: bar"
+    ]
+  },
+  "dataLicense": "CC0-1.0",
+  "documentNamespace": "https://tanzu.vmware.com/application-catalog/spdx/295c513b-b6cc-44c2-b19b-dc7196cdad9d",
+  "name": "SPDX document for nginx:18.0.3",
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-OperatingSystem-gnrtd1",
+      "downloadLocation": "NONE",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "name": "debian",
+      "primaryPackagePurpose": "OPERATING_SYSTEM",
+      "versionInfo": "12.0"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd7",
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]?arch=amd64\u0026distro=debian-12.0",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "BSD-3-Clause",
+      "licenseDeclared": "BSD-3-Clause",
+      "name": "libedit2",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: libedit 3.1-20221030-2",
+      "supplier": "Organization: LLVM Packaging Team \[email protected]\u003e",
+      "versionInfo": "3.1-20221030-2"
+    },
+    {
+      "SPDXID": "SPDXRef-OperatingSystem-gnrtd143",
+      "downloadLocation": "NONE",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "name": "debian",
+      "primaryPackagePurpose": "OPERATING_SYSTEM",
+      "versionInfo": "12.5"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd175",
+      "checksums": [
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "99a8c7dd591fae9fb37d8bf8dfdffa850e207fa405b3198c5b24711a5f972381"
+        }
+      ],
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]?arch=arm64\u0026distro=debian-12.5",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "MIT",
+      "licenseDeclared": "MIT",
+      "name": "libmd0",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: libmd 1.0.4-2",
+      "supplier": "Organization: Guillem Jover \[email protected]\u003e",
+      "versionInfo": "1.0.4-2"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd259",
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]%2Bdeb12u1?arch=arm64\u0026distro=debian-12.5",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "MIT",
+      "licenseDeclared": "MIT",
+      "name": "libmount1",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: util-linux 2.38.1-5+deb12u1",
+      "supplier": "Organization: util-linux packagers \[email protected]\u003e",
+      "versionInfo": "2.38.1-5+deb12u1"
+    }
+  ],
+  "relationships": [
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd7",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd1"
+    },
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd175",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd143"
+    },
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd259",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd143"
+    }
+  ],
+  "spdxVersion": "SPDX-2.3"
+}

integration/testdata/multiple-os.json.golden

@@ -0,0 +1,67 @@
+{
+  "SchemaVersion": 2,
+  "CreatedAt": "2021-08-25T12:20:30.000000005Z",
+  "ArtifactName": "testdata/fixtures/sbom/multiple-os.sdpx.json",
+  "ArtifactType": "spdx",
+  "Metadata": {
+    "OS": {
+      "Family": "debian",
+      "Name": "12.5"
+    },
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  },
+  "Results": [
+    {
+      "Target": "testdata/fixtures/sbom/multiple-os.sdpx.json (debian 12.5)",
+      "Class": "os-pkgs",
+      "Type": "debian",
+      "Packages": [
+        {
+          "ID": "[email protected]",
+          "Name": "libmd0",
+          "Identifier": {
+            "PURL": "pkg:deb/debian/[email protected]?arch=arm64\u0026distro=debian-12.5",
+            "UID": "bd94e402741d3988",
+            "BOMRef": "Package-gnrtd175"
+          },
+          "Version": "1.0.4-2",
+          "Arch": "arm64",
+          "SrcName": "libmd",
+          "SrcVersion": "1.0.4",
+          "SrcRelease": "2",
+          "Licenses": [
+            "MIT"
+          ],
+          "Layer": {}
+        },
+        {
+          "ID": "[email protected]+deb12u1",
+          "Name": "libmount1",
+          "Identifier": {
+            "PURL": "pkg:deb/debian/[email protected]%2Bdeb12u1?arch=arm64\u0026distro=debian-12.5",
+            "UID": "ae2f6c69df04ce11",
+            "BOMRef": "Package-gnrtd259"
+          },
+          "Version": "2.38.1-5+deb12u1",
+          "Arch": "arm64",
+          "SrcName": "util-linux",
+          "SrcVersion": "2.38.1",
+          "SrcRelease": "5+deb12u1",
+          "Licenses": [
+            "MIT"
+          ],
+          "Layer": {}
+        }
+      ]
+    }
+  ]
+}

pkg/fanal/analyzer/sbom/sbom_test.go

@@ -42,6 +42,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:      "apm-agent",
 										Version:   "1.36.0",
 									},
+									BOMRef: "Package-f0db45781e6813a1",
 								},
 							},
 							{
@@ -56,6 +57,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:      "apm-agent-cached-lookup-key",
 										Version:   "1.36.0",
 									},
+									BOMRef: "Package-efe22bf5916f985f",
 								},
 							},
 							{
@@ -70,6 +72,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:      "apm-agent-common",
 										Version:   "1.36.0",
 									},
+									BOMRef: "Package-33d86d2d11abe114",
 								},
 							},
 							{
@@ -84,6 +87,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:      "apm-agent-core",
 										Version:   "1.36.0",
 									},
+									BOMRef: "Package-b905fcf69ca61281",
 								},
 							},
 						},
@@ -110,6 +114,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 											},
 										},
 									},
+									BOMRef: "elasticsearch",
 								},
 							},
 						},
@@ -184,6 +189,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:    "gdal",
 										Version: "3.7.1",
 									},
+									BOMRef: "gdal",
 								},
 							},
 							{
@@ -197,6 +203,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:    "geos",
 										Version: "3.8.3",
 									},
+									BOMRef: "geos",
 								},
 							},
 							{
@@ -210,6 +217,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:    "postgresql",
 										Version: "15.3.0",
 									},
+									BOMRef: "postgresql",
 								},
 								DependsOn: []string{
 									"[email protected]",
@@ -228,6 +236,7 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
 										Name:    "proj",
 										Version: "6.3.2",
 									},
+									BOMRef: "proj",
 								},
 							},
 						},

pkg/fanal/types/package.go

@@ -56,7 +56,7 @@ func (r *Relationship) UnmarshalJSON(data []byte) error {
 type PkgIdentifier struct {
 	UID    string                 `json:",omitempty"` // Calculated by the package struct
 	PURL   *packageurl.PackageURL `json:"-"`
-	BOMRef string                 `json:",omitempty"` // For CycloneDX
+	BOMRef string                 `json:",omitempty"` // Taken from `BOMRef` for CycloneDX or from `SPDXID` for SPDX.
 }
 
 // MarshalJSON customizes the JSON encoding of PkgIdentifier.

pkg/sbom/core/bom.go

@@ -133,7 +133,7 @@ type Component struct {
 	//   SPDX: package.externalRefs.referenceLocator
 	// BOMRef:
 	//   CycloneDX: component.bom-ref
-	//   SPDX: N/A
+	//   SPDX: package.SPDXID
 	PkgIdentifier ftypes.PkgIdentifier
 
 	// Supplier is the name of the supplier of the component