adoptium / adoptium/containers
[Bug]: Java package not recognized by SBOM creators
- Dominant language
- Python
- Stars
- 289
- Forks
- 129
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 12
Description
### Please add the exact image (with tag) that you are using
eclipse-temurin:17-jre-alpine
### Please add the version of Docker you are running
24.0.5
### What happened?
We are using `eclipse-temurin:17-jre-alpine` as base for many images. We are creating SBOMs (CycloneDX) for all our images using trivy. We discovered that these SBOMs do not include the JRE (but all other APKs from the base image). The reason is likely that the JRE is not installed as an APK but extracted from a Tar archive.
The question I have is whether you are aware of any SBOM creators that can still detect the JRE. Or are there any plans for providing a complete SBOM for the Docker image which we can then merge with our additions?
### Relevant log output
_No response_
Contributor guide
Research direction
Start by reproducing the SBOM output for eclipse-temurin:17-jre-alpine with Trivy and CycloneDX, then inspect how the JRE extracted from the image archive is represented. Compare available detection or image-SBOM approaches; done means documenting a supported solution or a clear project decision about providing a complete SBOM.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100