Replies: 2 comments 14 replies
-
|
Hello @bpapez At the moment I assume the following points:
If I'm right, I think best solution for you is to populate Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
Unfortunately, trivy-java-db only contains maven Central. I very want to help you, but it looks like you have only one solution - add information about GAV to these jars and overwrite them..
This ➜ cat ./jackrabbit-core/META-INF/maven/org.apache.jackrabbit/jackrabbit-core/pom.properties
artifactId=jackrabbit-core
groupId=org.apache.jackrabbit
version=2.20.12-jahia1-SNAPSHOT
It works for me. Can you compare your jar with with file from repository? ➜ wget https://devtools.jahia.com/nexus/content/groups/maven-jahia-org/org/drools/drools-compiler/6.0.0.Final/drools-compiler-6.0.0.Final-nocdi.jar
...
drools-compiler-6.0 100%[===================>] 1,44M 1,59MB/s in 0,9s
2024-04-24 10:46:38 (1,59 MB/s) - ‘drools-compiler-6.0.0.Final-nocdi.jar’ saved [1507761/1507761]
➜ trivy -q rootfs -f json --list-all-pkgs ./drools-compiler-6.0.0.Final-nocdi.jar | jq ' .Results[].Packages[] | select(.Name=="org.drools:drools-compiler")'
{
"Name": "org.drools:drools-compiler",
"Identifier": {
"PURL": "pkg:maven/org.drools/drools-compiler@6.0.0.Final"
},
"Version": "6.0.0.Final",
"Layer": {},
"FilePath": "drools-compiler-6.0.0.Final-nocdi.jar"
}
Can you share link on this jar? Perhaps
New Trivy should not detect this can. Are you using the new Trivy for scanning? |
Beta Was this translation helpful? Give feedback.
-
I will create internal tickets to try doing that. For the jars, which were created by us from a fork it should not be a problem. However I think its bad that we will need to create new forks from 3rd party repos, which we have not changed, just to add a
Sorry, my mistake. That jar is getting correctly detected. I shouldn't have placed it on that list.
I already gave you the link : https://repo1.maven.org/maven2/org/eclipse/jdt/core/compiler/ecj/
The wrong package/groupID guess was done in Trivy 0.48. The newer Trivy versions are not listing that file at all in the SBOM although it is there. I gave you the link to the forked artifact jar which we use in our image. As this is a forked jar, I hope it is not a big issue to add the |
Beta Was this translation helpful? Give feedback.
-
Trivy checks
Do
We take these fields from MANIFEST.MF. For GroupID we use these fields.
I realized what the problem is - it is very strange that one organization uses different GroupIDs:
I'll try to update our logic for these cases (we stop checking subdirectories if |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Related issue - aquasecurity/trivy-java-db#28 |
Beta Was this translation helpful? Give feedback.
-
Description
In our project we create the SBOM with the Trivy image scan (format cyclonedy). Since Trivy version 0.49.0 the SBOM is no longer containing several JARs, which use a qualifier other than SNAPSHOT.
Desired Behavior
Dependencies with custom qualifiers in the version should still be detected and listed in the SBOM.
Actual Behavior
For instance jasypt-1.9.3-lite.jar. The log shows
although it exists in a central repository (see link above). It still worked correctly with Trivy 0.48.3.
We have about 30 dependencies like that, which now disappeared from the SBOM. Some of these jars are built by us from forked repositories, where we either backported a patch or where we had to make a JAR work well with OSGI. For that we keep the same version, but we add a custom qualifier, which is a valid practice. Also Dependency Track was able to report vulnerabilities on them, therefore it is important that such files do not get simply removed from the SBOM.
For now we have to stick with Trivy 0.48.3 . Could this get fixed again please or is there an option we could use to still get a correct SBOM with the latest Trivy? I tried
--offline-scan, but that did not make a difference.Reproduction Steps
Target
Container Image
Scanner
None
Output Format
CycloneDX
Mode
Standalone
Debug Output
2024-02-29T12:29:58.871Z DEBUG Parsing Java artifacts... {"file": "usr/local/tomcat/webapps/ROOT/WEB-INF/lib/jasypt-1.9.3-lite.jar"} 2024-02-29T12:29:58.872Z DEBUG No such POM in the central repositories {"file": "jasypt-1.9.3-lite.jar"}Operating System
I use the provided Docker image on different OS
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions