Does trivy support scanning of images which contain jars created using gradle/bazel? Or is it limited to maven?

[namandf]

Question

Does trivy support scanning of images which contain jars created using gradle/bazel? Or is it limited to maven?

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

None

Operating System

No response

Version

No response

[itaysk]

https://aquasecurity.github.io/trivy/v0.50/docs/coverage/language/java/

[namandf]

Hi @itaysk , Hope you are doing great. Thank you for the update. I did check the documentation. It just states supporting scanning of jars/wars/ears , but does not state whether its applicable across all build tools. I see some inconsistencies for jars built using gradle and bazel, hence the question

[knqyf263]

Are there any differences in JAR files depending on build tools?

[namandf]

Yeah looks like we were able to figure out the root cause. If there are some direct/indirect dependencies which are fetched from maven, the pom.properties is present and is being used to identify the packages, but if they were built using gradle/bazel and even though the packages are expected to be fetched from maven central, then Trivy cannot detect those. This results in inaccurate SBOMs and missing packages in the trivy report

gradle/gradle#23578

[knqyf263]

Does gradle embed something else like pom.properties? If so, we can add support for it.

[namandf]

If the direct dependency is built using maven then the jar is packaged with both pom.xml and pom.properties. We could potentially enable the pom analyzer for image scans and deduplicate packages.
But if the direct dependency itself is built using gradle , then the jar contains only compiled classes. We could potentially use file path but it could be error prone and version information would anyway not be available.