Image scan with native application

[bedla]

Description

Hi,
I want to know you opinion about following use-case.

Let's have following use-case:

• Java/Kotlin application build with GraalVM AOT Native build (.jar libs are baked into executable)
• Application is distributed as Docker Image
• SBOM is generated and saved into for example Artifactory

If I understand correctly current behavior of Trivy:

• baked .jar libs are not scanned because Trivy does not know about them
• Only artifacts in Image itself are scanned
• There is no way how to tell Trivy to also use SBOM (I saw remote-sbom config, but it is something different - I guess)

What do you think?

Thx

Ivos

Target

Container Image

Scanner

Vulnerability

[bedla]

Note this applies alto to any other Native build, like Go, C, etc.

[itaysk]

hi, if you generated the sbom from source, you can just scan the sbom and not the image. if you want to attach the sbom to the image, current supported ways are using sigstore or oci reference

[bedla]

Hi, thx for answer (I just missed it).
Does it mean, that if I will have image with attached SBOM, Trivy will also include this data during imae scan?
Thx
Ivos

[itaysk]

please see here: https://aquasecurity.github.io/trivy/v0.52/docs/target/container_image/#discovery

[bedla]

I see, thank you for answer.

(I will experiment with it now)