Replies: 1 comment 6 replies
-
|
Hello @wkoot These components were found from different lock files:
That is why we create 2 components for regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
Because the data is duplicate as far as the python lib's equality check is concerned, data is lost upon deserialization. |
Beta Was this translation helpful? Give feedback.
-
|
Hello @wkoot as far as I remember - libraries for different languages are developed by different people. Because of this, it may be difficult to understand controversial points. Let's wait for the answer at CycloneDX/cyclonedx-cli#399 |
Beta Was this translation helpful? Give feedback.
-
|
I don't think waiting will bring much as there is no agreement on merging algorithms, see CycloneDX/specification#320. In this example, With this approach, the other data objects in |
Beta Was this translation helpful? Give feedback.
-
|
For example, identical packages installed in different paths would not be nested as they don't have parents and are added twice as root-level components in the current implementation. We didn't have any other idea for that. Also, is it discussed anywhere that identical components should not appear at the top level but only if they are nested? They happen to have the same name and version, but have different dependencies and are effectively different components. We don't currently see anything wrong with them being added to the top level, but we would like to fix it if it seems to violate anything. Just so you know, we had a similar discussion before. |
Beta Was this translation helpful? Give feedback.
-
I took this from CycloneDX/cyclonedx-python-lib#540 (comment) (see also CycloneDX/cyclonedx-python-lib#540 (comment) above) Note that it is also disputed in a change (and test) I proposed with CycloneDX/cyclonedx-python-lib#678 (comment) |
Beta Was this translation helpful? Give feedback.
-
Description
I obtain the following two components which only differ by their
bom-ref, within a single scan.Only the first occurrence is listed in the bom dependencies, in both
refanddependsOnfields.Not sure if (and if so, how) this is related to #7337, so opened as a separate discussion.
This scan and outputfile was produced with the docker image
aquasec/trivy:0.55.1as follows:Component 1:
{ "bom-ref": "94eaf415-366a-4b26-a674-b420104ca7c1", "type": "library", "name": "rustc-hash", "version": "1.1.0", "purl": "pkg:cargo/[email protected]", "properties": [ { "name": "aquasecurity:trivy:LayerDiffID", "value": "sha256:8b5007c54c56542ac66ec8b852df39a01ec8b91d25a6acfad20f06a22b18c120" }, { "name": "aquasecurity:trivy:LayerDigest", "value": "sha256:8d5593650f650634958fa2a500069bc1ec634d9d575347f35175e51a5a84e1a3" }, { "name": "aquasecurity:trivy:PkgID", "value": "[email protected]" }, { "name": "aquasecurity:trivy:PkgType", "value": "cargo" } ] }Component 2:
{ "bom-ref": "8b603731-118f-42a7-9190-aa409f64c2f3", "type": "library", "name": "rustc-hash", "version": "1.1.0", "purl": "pkg:cargo/[email protected]", "properties": [ { "name": "aquasecurity:trivy:LayerDiffID", "value": "sha256:8b5007c54c56542ac66ec8b852df39a01ec8b91d25a6acfad20f06a22b18c120" }, { "name": "aquasecurity:trivy:LayerDigest", "value": "sha256:8d5593650f650634958fa2a500069bc1ec634d9d575347f35175e51a5a84e1a3" }, { "name": "aquasecurity:trivy:PkgID", "value": "[email protected]" }, { "name": "aquasecurity:trivy:PkgType", "value": "cargo" } ] }Desired Behavior
Components 1 and 2 should be deduplicated, only leaving a single component - to which the vulnerabilities and dependencies are linked.
Actual Behavior
Two duplicate components were produced, which only differ from each other in their
bom-ref.Reproduction Steps
Target
Container Image
Scanner
Vulnerability
Output Format
CycloneDX
Mode
Standalone
Debug Output
Operating System
Docker version 26.1.0, build 9714adc, Rocky Linux release 8.9 (Green Obsidian)
Version
# trivy --version Version: 0.55.1Checklist
trivy clean --allBeta Was this translation helpful? Give feedback.
All reactions