fix(sbom): detect main OS and ignore pkgs for other OSes

integration/sbom_test.go

@@ -20,6 +20,7 @@ func TestSBOM(t *testing.T) {
 		format       string
 		artifactType string
 		scanners     string
+		listAllPkgs  bool
 	}
 	tests := []struct {
 		name     string
@@ -129,6 +130,16 @@ func TestSBOM(t *testing.T) {
 			},
 			golden: "testdata/license-cyclonedx.json.golden",
 		},
+		{
+			name: "multiple OSes",
+			args: args{
+				input:        "testdata/fixtures/sbom/multiple-os.sdpx.json",
+				format:       "json",
+				artifactType: "spdx",
+				listAllPkgs:  true,
+			},
+			golden: "testdata/multiple-os.json.golden",
+		},
 	}
 
 	// Set up testing DB
@@ -162,6 +173,10 @@ func TestSBOM(t *testing.T) {
 			osArgs = append(osArgs, "--output", outputFile)
 			osArgs = append(osArgs, tt.args.input)
 
+			if tt.args.listAllPkgs {
+				osArgs = append(osArgs, "--list-all-pkgs")
+			}
+
 			// Run "trivy sbom"
 			runTest(t, osArgs, tt.golden, outputFile, types.Format(tt.args.format), runOptions{
 				override: overrideFuncs(overrideSBOMReport, overrideUID, tt.override),

integration/testdata/fixtures/sbom/multiple-os.sdpx.json

@@ -0,0 +1,86 @@
+{
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2024-06-10T14:07:15Z",
+    "creators": [
+      "Organization: foo",
+      "Tool: bar"
+    ]
+  },
+  "dataLicense": "CC0-1.0",
+  "documentNamespace": "https://tanzu.vmware.com/application-catalog/spdx/295c513b-b6cc-44c2-b19b-dc7196cdad9d",
+  "name": "SPDX document for nginx:18.0.3",
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-OperatingSystem-gnrtd1",
+      "downloadLocation": "NONE",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "name": "debian",
+      "primaryPackagePurpose": "OPERATING_SYSTEM",
+      "versionInfo": "12.5"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd7",
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]?arch=amd64\u0026distro=debian-12.5",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "BSD-3-Clause",
+      "licenseDeclared": "BSD-3-Clause",
+      "name": "libedit2",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: libedit 3.1-20221030-2",
+      "supplier": "Organization: LLVM Packaging Team \[email protected]\u003e",
+      "versionInfo": "3.1-20221030-2"
+    },
+    {
+      "SPDXID": "SPDXRef-OperatingSystem-gnrtd143",
+      "downloadLocation": "NONE",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "name": "debian",
+      "primaryPackagePurpose": "OPERATING_SYSTEM",
+      "versionInfo": "12.5"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd259",
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]%2Bdeb12u1?arch=arm64\u0026distro=debian-12.5",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "(LicenseRef-public-domain AND LGPL-2.0-only AND LGPL-3.0-only AND BSD-4-Clause AND LGPL-2.1-only AND BSD-3-Clause AND MIT AND GPL-3.0-only AND GPL-2.0-only AND LicenseRef-BSLA)",
+      "licenseDeclared": "(LicenseRef-public-domain AND LGPL-2.0-only AND LGPL-3.0-only AND BSD-4-Clause AND LGPL-2.1-only AND BSD-3-Clause AND MIT AND GPL-3.0-only AND GPL-2.0-only AND LicenseRef-BSLA)",
+      "name": "libmount1",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: util-linux 2.38.1-5+deb12u1",
+      "supplier": "Organization: util-linux packagers \[email protected]\u003e",
+      "versionInfo": "2.38.1-5+deb12u1"
+    }
+  ],
+  "relationships": [
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd7",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd1"
+    },
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd259",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd143"
+    }
+  ],
+  "spdxVersion": "SPDX-2.3"
+}

integration/testdata/multiple-os.json.golden

@@ -0,0 +1,65 @@
+{
+  "SchemaVersion": 2,
+  "CreatedAt": "2021-08-25T12:20:30.000000005Z",
+  "ArtifactName": "testdata/fixtures/sbom/multiple-os.sdpx.json",
+  "ArtifactType": "spdx",
+  "Metadata": {
+    "OS": {
+      "Family": "debian",
+      "Name": "12.5"
+    },
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  },
+  "Results": [
+    {
+      "Target": "testdata/fixtures/sbom/multiple-os.sdpx.json (debian 12.5)",
+      "Class": "os-pkgs",
+      "Type": "debian",
+      "Packages": [
+        {
+          "ID": "[email protected]",
+          "Name": "libedit2",
+          "Identifier": {
+            "PURL": "pkg:deb/debian/[email protected]?arch=amd64\u0026distro=debian-12.5",
+            "UID": "d9c0b51d2f4afa4d"
+          },
+          "Version": "3.1-20221030-2",
+          "Arch": "amd64",
+          "SrcName": "libedit",
+          "SrcVersion": "3.1-20221030",
+          "SrcRelease": "2",
+          "Licenses": [
+            "BSD-3-Clause"
+          ],
+          "Layer": {}
+        },
+        {
+          "ID": "[email protected]+deb12u1",
+          "Name": "libmount1",
+          "Identifier": {
+            "PURL": "pkg:deb/debian/[email protected]%2Bdeb12u1?arch=arm64\u0026distro=debian-12.5",
+            "UID": "104ee5d0a32c0520"
+          },
+          "Version": "2.38.1-5+deb12u1",
+          "Arch": "arm64",
+          "SrcName": "util-linux",
+          "SrcVersion": "2.38.1",
+          "SrcRelease": "5+deb12u1",
+          "Licenses": [
+            "(LicenseRef-public-domain AND LGPL-2.0-only AND LGPL-3.0-only AND BSD-4-Clause AND LGPL-2.1-only AND BSD-3-Clause AND MIT AND GPL-3.0-only AND GPL-2.0-only AND LicenseRef-BSLA)"
+          ],
+          "Layer": {}
+        }
+      ]
+    }
+  ]
+}

pkg/sbom/io/decode.go

@@ -10,6 +10,7 @@ import (
 	debver "github.com/knqyf263/go-deb-version"
 	rpmver "github.com/knqyf263/go-rpm-version"
 	"github.com/package-url/packageurl-go"
+	"github.com/samber/lo"
 	"golang.org/x/exp/maps"
 	"golang.org/x/xerrors"
 
@@ -375,8 +376,12 @@ func (m *Decoder) addOrphanPkgs(sbom *types.SBOM) error {
 
 		// TODO: mismatch between the OS and the packages should be rejected.
 		// e.g. OS: debian, Packages: rpm
-		sort.Sort(pkgs)
-		sbom.Packages = append(sbom.Packages, ftypes.PackageInfo{Packages: pkgs})
+
+		// `applier` package merges `PackageInfo` elements  along the filepath,
+		// but sbom files may not contain filepath for OS packages.
+		// In these cases we will overwrite `PackageInfo` and miss some `Packages`.
+		// This is why we need to merge all found `Packages` into one `PackageInfo`.
+		sbom.Packages = appendOrphanPkgsToPackageInfo(sbom.Packages, pkgs)
 
 		break // Just take the first element
 	}
@@ -391,3 +396,25 @@ func (m *Decoder) addOrphanPkgs(sbom *types.SBOM) error {
 	}
 	return nil
 }
+
+// appendOrphanPkgsToPackageInfo merges `orphanPkgs` into `packages[0]` (the comparison is done by PURL).
+// Merged `Packages` are sorted.
+func appendOrphanPkgsToPackageInfo(packages []ftypes.PackageInfo, orphanPkgs ftypes.Packages) []ftypes.PackageInfo {
+	// Length of `packages` can be only 0 or 1
+	// packages[].FilePath is always empty
+	// cf. https://github.com/aquasecurity/trivy/blob/09e50ce6a82073ba62f1732d5aa0cd2701578693/pkg/sbom/io/decode.go#L331
+	var pkgs ftypes.Packages
+	if len(packages) == 1 { //
+		pkgs = packages[0].Packages
+	}
+	pkgs = append(pkgs, orphanPkgs...)
+	pkgs = lo.UniqBy(pkgs, func(pkg ftypes.Package) string {
+		return pkg.Identifier.PURL.String()
+	})
+	sort.Sort(pkgs)
+	return []ftypes.PackageInfo{
+		{
+			Packages: pkgs,
+		},
+	}
+}