anchore / anchore/syft

Binary copied to image omitted from SBOM

Open
#2,828 5 comments 0 reactions 0 assignees View on GitHub
binary-analysis enhancement good-first-issue
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:
SBOM is missing principle binary artifact from image
https://github.com/envoyproxy/envoy/blob/release/v1.27/ci/Dockerfile-envoy
```
ARG ENVOY_BINARY=envoy
ARG ENVOY_BINARY_PREFIX=
COPY --from=binary --chown=0:0 --chmod=755 \
"/usr/local/bin/${ENVOY_BINARY_PREFIX}${ENVOY_BINARY}" /usr/local/bin/envoy
```

**What you expected to happen**:
```
NAME VERSION TYPE
adduser 3.118ubuntu2 deb
apt 2.0.10 deb
base-files 11ubuntu5.8 deb
base-passwd 3.5.47 deb
bash 5.0-6ubuntu1.2 deb
bash 5.0.17 binary
...
envoy 1.27.5 binary
```
**Steps to reproduce the issue**:
syft scan --from registry envoyproxy/envoy:v1.27-latest

**Environment**:
- syft 1.3.0
- OS: attempted on macOS and Centos

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with `syft scan --from registry envoyproxy/envoy:v1.27-latest`, then trace Syft's binary discovery and image-layer analysis using the reported Dockerfile as context. Done means the generated SBOM includes the copied `envoy` binary with its version and type shown as `binary`, without losing existing package entries.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.