adoptium / adoptium/containers

[Bug]: Java package not recognized by SBOM creators

Open
#646 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
289
Forks
129
Avg merge
1d 12h
Merged PRs (30d)
12

Description

### Please add the exact image (with tag) that you are using

eclipse-temurin:17-jre-alpine

### Please add the version of Docker you are running

24.0.5

### What happened?

We are using `eclipse-temurin:17-jre-alpine` as base for many images. We are creating SBOMs (CycloneDX) for all our images using trivy. We discovered that these SBOMs do not include the JRE (but all other APKs from the base image). The reason is likely that the JRE is not installed as an APK but extracted from a Tar archive.
The question I have is whether you are aware of any SBOM creators that can still detect the JRE. Or are there any plans for providing a complete SBOM for the Docker image which we can then merge with our additions?

### Relevant log output

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the SBOM output for eclipse-temurin:17-jre-alpine with Trivy and CycloneDX, then inspect how the JRE extracted from the image archive is represented. Compare available detection or image-SBOM approaches; done means documenting a supported solution or a clear project decision about providing a complete SBOM.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, java
Domain
devops, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.