anchore / anchore/syft

Redis modules (.so) in redis:latest are not included in Syft SBOM

Open
#4,667 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

Hello,

I was analyzing SBOM completeness for container images using Syft and noticed that Redis modules present in the redis:latest image are not included in the generated SBOM.

Inside the container, the following Redis modules exist:

/usr/local/lib/redis/modules/

Files:

- redisbloom.so
- redisearch.so
- redistimeseries.so
- rejson.so

I verified this by running:

docker run -it redis:latest bash
ls /usr/local/lib/redis/modules/

However, when generating an SBOM using Syft, these modules do not appear in the component list.

Example commands:

syft redis:latest -o table | grep redis

Output:

redis 8.6.1 binary

CycloneDX output:

syft redis:latest -o cyclonedx-json | jq '.components[].name' | grep redis

Output:

"redis"
"/usr/local/bin/redis-server"

The Redis modules are not included in the SBOM.

Environment:

Syft version: 1.42.2
Image: redis:latest

Question:

Is this expected behavior because these modules are standalone shared libraries (.so) that are not associated with a package manager?

Or would it be useful for Syft to detect such modules as components in the SBOM?

Thanks for your work on Syft!

Contributor guide

Open the contributing guide

Research direction

Reproduce the report with `docker run -it redis:latest bash`, inspect `/usr/local/lib/redis/modules/`, and compare it with Syft's table and CycloneDX output. Determine whether standalone `.so` modules should be represented as components; done means the expected behavior is established and, if inclusion is intended, the modules appear in the component list.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go, redis
Domain
devtools, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.