docker / docker/scout-cli

scout sbom: components link its own file as subcomponent

Open
#171 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
454
Forks
134
PR merge metrics
No merged PRs in 30d

Description

When creating an SBOM file with the docker scout sbom --format cyclonedx ... command, I noticed that a component links its own file (.dll) as a subcomponent.
Example of a component:

{
  "bom-ref": "package-pkg-nuget-System.Collections-8.0.1124.51707",
  "type": "application",
  "supplier": {
    "name": "Microsoft Corporation"
  },
  "name": "System.Collections",
  "version": "8.0.1124.51707",
  "purl": "pkg:nuget/System.Collections@8.0.1124.51707",
  "components": [
    {
      "bom-ref": "File---usr-share-dotnet-shared-Microsoft.NETCore.App-8.0.11-System.Collections.dll",
      "type": "file",
      "name": "/usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.11/System.Collections.dll"
    }
  ]
}

In the end there exists two components, one is the file without further information such as version number and the other is the actual component with all the necessary information.
In my Opinion the file shouldn't be a component itself or a subcomponent (see Cylonedx-Doc https://cyclonedx.org/docs/1.6/json/#components_items_components)

If you have any questions, I'm happy to help.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported docker scout sbom --format cyclonedx ... command and inspect the generated CycloneDX component relationships. Trace the SBOM generation entry point to see why the component's own .dll is emitted as a subcomponent. Done means the duplicate file component is absent while the actual component retains its available metadata.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.