Binary copied to image omitted from SBOM
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What happened**:
SBOM is missing principle binary artifact from image
https://github.com/envoyproxy/envoy/blob/release/v1.27/ci/Dockerfile-envoy
```
ARG ENVOY_BINARY=envoy
ARG ENVOY_BINARY_PREFIX=
COPY --from=binary --chown=0:0 --chmod=755 \
"/usr/local/bin/${ENVOY_BINARY_PREFIX}${ENVOY_BINARY}" /usr/local/bin/envoy
```
**What you expected to happen**:
```
NAME VERSION TYPE
adduser 3.118ubuntu2 deb
apt 2.0.10 deb
base-files 11ubuntu5.8 deb
base-passwd 3.5.47 deb
bash 5.0-6ubuntu1.2 deb
bash 5.0.17 binary
...
envoy 1.27.5 binary
```
**Steps to reproduce the issue**:
syft scan --from registry envoyproxy/envoy:v1.27-latest
**Environment**:
- syft 1.3.0
- OS: attempted on macOS and Centos
Contributor guide
Research direction
Start by reproducing the issue with `syft scan --from registry envoyproxy/envoy:v1.27-latest`, then trace Syft's binary discovery and image-layer analysis using the reported Dockerfile as context. Done means the generated SBOM includes the copied `envoy` binary with its version and type shown as `binary`, without losing existing package entries.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100