fix(sbom): detect main OS and ignore pkgs for other OSes

integration/sbom_test.go

@@ -20,6 +20,7 @@ func TestSBOM(t *testing.T) {
 		format       string
 		artifactType string
 		scanners     string
+		listAllPkgs  bool
 	}
 	tests := []struct {
 		name     string
@@ -101,6 +102,11 @@ func TestSBOM(t *testing.T) {
 
 				require.Len(t, got.Results, 1)
 				want.Results[0].Target = "testdata/fixtures/sbom/centos-7-spdx.txt (centos 7.6.1810)"
+
+				require.Len(t, got.Results[0].Vulnerabilities, 3)
+				want.Results[0].Vulnerabilities[0].PkgIdentifier.SPDXID = "Package-5a18334f22149877"
+				want.Results[0].Vulnerabilities[1].PkgIdentifier.SPDXID = "Package-e16b1cbaa5186199"
+				want.Results[0].Vulnerabilities[2].PkgIdentifier.SPDXID = "Package-e16b1cbaa5186199"
 			},
 		},
 		{
@@ -117,6 +123,11 @@ func TestSBOM(t *testing.T) {
 
 				require.Len(t, got.Results, 1)
 				want.Results[0].Target = "testdata/fixtures/sbom/centos-7-spdx.json (centos 7.6.1810)"
+
+				require.Len(t, got.Results[0].Vulnerabilities, 3)
+				want.Results[0].Vulnerabilities[0].PkgIdentifier.SPDXID = "Package-5a18334f22149877"
+				want.Results[0].Vulnerabilities[1].PkgIdentifier.SPDXID = "Package-e16b1cbaa5186199"
+				want.Results[0].Vulnerabilities[2].PkgIdentifier.SPDXID = "Package-e16b1cbaa5186199"
 			},
 		},
 		{
@@ -129,6 +140,16 @@ func TestSBOM(t *testing.T) {
 			},
 			golden: "testdata/license-cyclonedx.json.golden",
 		},
+		{
+			name: "multiple OSes",
+			args: args{
+				input:        "testdata/fixtures/sbom/multiple-os.sdpx.json",
+				format:       "json",
+				artifactType: "spdx",
+				listAllPkgs:  true,
+			},
+			golden: "testdata/multiple-os.json.golden",
+		},
 	}
 
 	// Set up testing DB
@@ -162,6 +183,10 @@ func TestSBOM(t *testing.T) {
 			osArgs = append(osArgs, "--output", outputFile)
 			osArgs = append(osArgs, tt.args.input)
 
+			if tt.args.listAllPkgs {
+				osArgs = append(osArgs, "--list-all-pkgs")
+			}
+
 			// Run "trivy sbom"
 			runTest(t, osArgs, tt.golden, outputFile, types.Format(tt.args.format), runOptions{
 				override: overrideFuncs(overrideSBOMReport, overrideUID, tt.override),

integration/testdata/conda-spdx.json.golden

@@ -14,7 +14,7 @@
   "packages": [
     {
       "name": "openssl",
-      "SPDXID": "SPDXRef-Package-22a178da112ac20a",
+      "SPDXID": "SPDXRef-Package-74f10992fa41252a",
       "versionInfo": "1.1.1q",
       "supplier": "NOASSERTION",
       "downloadLocation": "NONE",
@@ -38,7 +38,7 @@
     },
     {
       "name": "pip",
-      "SPDXID": "SPDXRef-Package-c22b9ee9a601ba6",
+      "SPDXID": "SPDXRef-Package-6db6f5316e8b8cd5",
       "versionInfo": "22.2.2",
       "supplier": "NOASSERTION",
       "downloadLocation": "NONE",
@@ -103,22 +103,22 @@
     },
     {
       "spdxElementId": "SPDXRef-Filesystem-2e2426fd0f2580ef",
-      "relatedSpdxElement": "SPDXRef-Package-22a178da112ac20a",
+      "relatedSpdxElement": "SPDXRef-Package-6db6f5316e8b8cd5",
       "relationshipType": "CONTAINS"
     },
     {
       "spdxElementId": "SPDXRef-Filesystem-2e2426fd0f2580ef",
-      "relatedSpdxElement": "SPDXRef-Package-c22b9ee9a601ba6",
+      "relatedSpdxElement": "SPDXRef-Package-74f10992fa41252a",
       "relationshipType": "CONTAINS"
     },
     {
-      "spdxElementId": "SPDXRef-Package-22a178da112ac20a",
-      "relatedSpdxElement": "SPDXRef-File-600e5e0110a84891",
+      "spdxElementId": "SPDXRef-Package-6db6f5316e8b8cd5",
+      "relatedSpdxElement": "SPDXRef-File-7eb62e2a3edddc0a",
       "relationshipType": "CONTAINS"
     },
     {
-      "spdxElementId": "SPDXRef-Package-c22b9ee9a601ba6",
-      "relatedSpdxElement": "SPDXRef-File-7eb62e2a3edddc0a",
+      "spdxElementId": "SPDXRef-Package-74f10992fa41252a",
+      "relatedSpdxElement": "SPDXRef-File-600e5e0110a84891",
       "relationshipType": "CONTAINS"
     }
   ]

integration/testdata/fixtures/sbom/multiple-os.sdpx.json

@@ -0,0 +1,116 @@
+{
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2024-06-10T14:07:15Z",
+    "creators": [
+      "Organization: foo",
+      "Tool: bar"
+    ]
+  },
+  "dataLicense": "CC0-1.0",
+  "documentNamespace": "https://tanzu.vmware.com/application-catalog/spdx/295c513b-b6cc-44c2-b19b-dc7196cdad9d",
+  "name": "SPDX document for nginx:18.0.3",
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-OperatingSystem-gnrtd1",
+      "downloadLocation": "NONE",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "name": "debian",
+      "primaryPackagePurpose": "OPERATING_SYSTEM",
+      "versionInfo": "12.0"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd7",
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]?arch=amd64\u0026distro=debian-12.0",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "BSD-3-Clause",
+      "licenseDeclared": "BSD-3-Clause",
+      "name": "libedit2",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: libedit 3.1-20221030-2",
+      "supplier": "Organization: LLVM Packaging Team \[email protected]\u003e",
+      "versionInfo": "3.1-20221030-2"
+    },
+    {
+      "SPDXID": "SPDXRef-OperatingSystem-gnrtd143",
+      "downloadLocation": "NONE",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "name": "debian",
+      "primaryPackagePurpose": "OPERATING_SYSTEM",
+      "versionInfo": "12.5"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd175",
+      "checksums": [
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "99a8c7dd591fae9fb37d8bf8dfdffa850e207fa405b3198c5b24711a5f972381"
+        }
+      ],
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]?arch=arm64\u0026distro=debian-12.5",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "MIT",
+      "licenseDeclared": "MIT",
+      "name": "libmd0",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: libmd 1.0.4-2",
+      "supplier": "Organization: Guillem Jover \[email protected]\u003e",
+      "versionInfo": "1.0.4-2"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-gnrtd259",
+      "downloadLocation": "NONE",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:deb/debian/[email protected]%2Bdeb12u1?arch=arm64\u0026distro=debian-12.5",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "MIT",
+      "licenseDeclared": "MIT",
+      "name": "libmount1",
+      "primaryPackagePurpose": "LIBRARY",
+      "sourceInfo": "built package from: util-linux 2.38.1-5+deb12u1",
+      "supplier": "Organization: util-linux packagers \[email protected]\u003e",
+      "versionInfo": "2.38.1-5+deb12u1"
+    }
+  ],
+  "relationships": [
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd7",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd1"
+    },
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd175",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd143"
+    },
+    {
+      "relatedSpdxElement": "SPDXRef-Package-gnrtd259",
+      "relationshipType": "CONTAINS",
+      "spdxElementId": "SPDXRef-OperatingSystem-gnrtd143"
+    }
+  ],
+  "spdxVersion": "SPDX-2.3"
+}

integration/testdata/julia-spdx.json.golden

@@ -14,7 +14,7 @@
   "packages": [
     {
       "name": "Manifest.toml",
-      "SPDXID": "SPDXRef-Application-18fc3597717a3e56",
+      "SPDXID": "SPDXRef-Application-59f79ca0738fe3b8",
       "downloadLocation": "NONE",
       "filesAnalyzed": false,
       "attributionTexts": [
@@ -25,7 +25,7 @@
     },
     {
       "name": "A",
-      "SPDXID": "SPDXRef-Package-7784b00da0cb0cb0",
+      "SPDXID": "SPDXRef-Package-67a1b8f47fb62608",
       "versionInfo": "1.9.0",
       "supplier": "NOASSERTION",
       "downloadLocation": "NONE",
@@ -48,7 +48,7 @@
     },
     {
       "name": "B",
-      "SPDXID": "SPDXRef-Package-960543ac5c5f7e10",
+      "SPDXID": "SPDXRef-Package-398725f971f94c30",
       "versionInfo": "1.9.0",
       "supplier": "NOASSERTION",
       "downloadLocation": "NONE",
@@ -71,7 +71,7 @@
     },
     {
       "name": "B",
-      "SPDXID": "SPDXRef-Package-a4705eb108e4f15c",
+      "SPDXID": "SPDXRef-Package-8401333085c41d28",
       "versionInfo": "1.9.0",
       "supplier": "NOASSERTION",
       "downloadLocation": "NONE",
@@ -105,18 +105,18 @@
   ],
   "relationships": [
     {
-      "spdxElementId": "SPDXRef-Application-18fc3597717a3e56",
-      "relatedSpdxElement": "SPDXRef-Package-7784b00da0cb0cb0",
+      "spdxElementId": "SPDXRef-Application-59f79ca0738fe3b8",
+      "relatedSpdxElement": "SPDXRef-Package-398725f971f94c30",
       "relationshipType": "CONTAINS"
     },
     {
-      "spdxElementId": "SPDXRef-Application-18fc3597717a3e56",
-      "relatedSpdxElement": "SPDXRef-Package-960543ac5c5f7e10",
+      "spdxElementId": "SPDXRef-Application-59f79ca0738fe3b8",
+      "relatedSpdxElement": "SPDXRef-Package-67a1b8f47fb62608",
       "relationshipType": "CONTAINS"
     },
     {
-      "spdxElementId": "SPDXRef-Application-18fc3597717a3e56",
-      "relatedSpdxElement": "SPDXRef-Package-a4705eb108e4f15c",
+      "spdxElementId": "SPDXRef-Application-59f79ca0738fe3b8",
+      "relatedSpdxElement": "SPDXRef-Package-8401333085c41d28",
       "relationshipType": "CONTAINS"
     },
     {
@@ -126,12 +126,12 @@
     },
     {
       "spdxElementId": "SPDXRef-Filesystem-1be792dd0077c431",
-      "relatedSpdxElement": "SPDXRef-Application-18fc3597717a3e56",
+      "relatedSpdxElement": "SPDXRef-Application-59f79ca0738fe3b8",
       "relationshipType": "CONTAINS"
     },
     {
-      "spdxElementId": "SPDXRef-Package-7784b00da0cb0cb0",
-      "relatedSpdxElement": "SPDXRef-Package-960543ac5c5f7e10",
+      "spdxElementId": "SPDXRef-Package-67a1b8f47fb62608",
+      "relatedSpdxElement": "SPDXRef-Package-398725f971f94c30",
       "relationshipType": "DEPENDS_ON"
     }
   ]

integration/testdata/multiple-os.json.golden

@@ -0,0 +1,67 @@
+{
+  "SchemaVersion": 2,
+  "CreatedAt": "2021-08-25T12:20:30.000000005Z",
+  "ArtifactName": "testdata/fixtures/sbom/multiple-os.sdpx.json",
+  "ArtifactType": "spdx",
+  "Metadata": {
+    "OS": {
+      "Family": "debian",
+      "Name": "12.5"
+    },
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  },
+  "Results": [
+    {
+      "Target": "testdata/fixtures/sbom/multiple-os.sdpx.json (debian 12.5)",
+      "Class": "os-pkgs",
+      "Type": "debian",
+      "Packages": [
+        {
+          "ID": "[email protected]",
+          "Name": "libmd0",
+          "Identifier": {
+            "PURL": "pkg:deb/debian/[email protected]?arch=arm64\u0026distro=debian-12.5",
+            "UID": "1a40caf90922a802",
+            "SPDXID": "Package-gnrtd175"
+          },
+          "Version": "1.0.4-2",
+          "Arch": "arm64",
+          "SrcName": "libmd",
+          "SrcVersion": "1.0.4",
+          "SrcRelease": "2",
+          "Licenses": [
+            "MIT"
+          ],
+          "Layer": {}
+        },
+        {
+          "ID": "[email protected]+deb12u1",
+          "Name": "libmount1",
+          "Identifier": {
+            "PURL": "pkg:deb/debian/[email protected]%2Bdeb12u1?arch=arm64\u0026distro=debian-12.5",
+            "UID": "f5f492c064df8ae2",
+            "SPDXID": "Package-gnrtd259"
+          },
+          "Version": "2.38.1-5+deb12u1",
+          "Arch": "arm64",
+          "SrcName": "util-linux",
+          "SrcVersion": "2.38.1",
+          "SrcRelease": "5+deb12u1",
+          "Licenses": [
+            "MIT"
+          ],
+          "Layer": {}
+        }
+      ]
+    }
+  ]
+}