DependencyTrack / DependencyTrack/dependency-track

Trivy analyzer can't detect SLES OS

Open
#4,051 2 comments 0 reactions 0 assignees View on GitHub
defect help wanted in triage integration/trivy
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Uploading sboms generated with trivy 0.53 for SLES 12.5 and 15.x can't be scanned by the trivy analyzer, because the OS is not detected by trivy, trivy 0.53 server log:
```
INFO Detected OS family="none" version=""
WARN Unsupported os family="none"
INFO Number of language-specific files num=0
```
[dtrack-logs-2024-08-08 17_28_28.txt](https://github.com/user-attachments/files/16550643/dtrack-logs-2024-08-08.17_28_28.txt)

### Steps to Reproduce

1. upload a trivy generated sbom with SLES 12.5 or 15.x OS packages: [trivy.json](https://github.com/user-attachments/files/16550651/trivy.json)
2. have dtrack configured to analyze with trivy
3. no OS dectected by trivy, no vulns in dtrack: [403cb7b7-81b6-4ffd-bbbb-dd910ea39249-withVulnerabilities.cdx.json](https://github.com/user-attachments/files/16550660/403cb7b7-81b6-4ffd-bbbb-dd910ea39249-withVulnerabilities.cdx.json)

### Expected Behavior

OS is set correctly by dtrack and discovered by trivy, like it does for example for redhat, and vulns are reported back to dtrack

### Dependency-Track Version

4.11.5

### Dependency-Track Distribution

Container Image

### Database Server

H2

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.