What happened : I am creating an SBOM for the <code class="notrans

I think this is because the <a href="https://github.com/anchore/syft/blob/dde5d349b1ee

Redis not listed in the artifact lists of the bitnami/redis image about syft HOT 2 OPEN

dwertent commented on June 9, 2024

Redis not listed in the artifact lists of the bitnami/redis image

from syft.

Comments (2)

willmurphyscode commented on June 9, 2024

I think this is because the binary classifier for redis matches against the amd64 build of redis but _not_the arm64 build.

❯ syft -q --platform=linux/amd64 docker.io/bitnami/redis@sha256:c1843bcdb2f413d2aff67adbaf482082673cd40ec602fa9fefad74ec685cb813 | grep -i ^redis
redis                             7.2.4                  binary
❯ syft -q --platform=linux/arm64 docker.io/bitnami/redis@sha256:c1843bcdb2f413d2aff67adbaf482082673cd40ec602fa9fefad74ec685cb813 | grep -i ^redis

I believe the digest points to a multi-architecture manifest, so when syft asks docker to pull the image, the client decides which platform to pull, and if the client pulls the linux/amd64 platform, redis is found, but not if it pulls the linux/arm64 platform.

I'll leave this issue open as a request to enhance the binary classifier to detect the arm64 build of redis.

from syft.

witchcraze commented on June 9, 2024

Please let me report additional not listed cases.

syft does not detect redis frmo 3/8 OS/ARCH of redis:latest.

$ syft -q --platform=linux/386 redis | grep redis
$

$ syft -q --platform=linux/arm/v5 redis | grep redis
$

$ syft -q --platform=linux/arm/v7 redis | grep redis
$

format includes text - buildkitsandbox

$ docker run -it --rm --platform linux/386 redis sh -c "apt update && apt install -y binutils && strings /usr/local/bin/redis-server | grep -E '7\.2\.4'"
:
:
:
7.2.4
7.2.4buildkitsandbox-1712714399000000000

$ docker run -it --rm --platform linux/arm/v5 redis sh -c "apt update && apt install -y binutils && strings /usr/local/bin/redis-server | grep -E '7\.2\.4'"
:
:
:
7.2.4
7.2.4buildkitsandbox-1712788833000000000

$ docker run -it --rm --platform linux/arm/v7 redis sh -c "apt update && apt install -y binutils && strings /usr/local/bin/redis-server | grep -E '7\.2\.4'"
:
:
:
7.2.4
7.2.4buildkitsandbox-1712788833000000000

bitnami

$ docker run -it --rm --platform=linux/arm64 --user root docker.io/bitnami/redis@sha256:c1843bcdb2f413d2aff67adbaf482082673cd40ec602fa9fefad74ec685cb813 sh -c "apt update && apt install -y binutils && strings /opt/bitnami/redis/bin/redis-server | grep -E '7\.2\.4'"
:
:
:
7.2.4
7.2.4af940fca2d06-1706617069000000000
/bitnami/blacksmith-sandox/redis-7.2.4/src
/bitnami/blacksmith-sandox/redis-7.2.4/deps/hiredis

from syft.

Recommend Projects