Not all the packages are getting imported in Blackduck scanner about syft

[tgerla]

Hi @Naranthiran, thanks for the report. Can you attach a copy of sbom.050524.json to this issue? It looks like there are a bunch of errors related to symlinks in the scan output. It would be helpful if we could also see the contents of the tar file. Could we have access to the tar file itself? If not, a complete file listing from the tar archive would be a good start. Thanks!

[Naranthiran]

Hi Tim,

I have attached the SBOM. The tar file is a filesystem which was created using the image builder tool.

If you have subscribed, you can generate the tar file from the RedHat console.

I will not be able to upload as the files size in huge..

sbom.050524.json

Regards
Naranthiran Duraisamy

[tgerla]

Hi @Naranthiran, I checked out the SBOM and I see over 600 entries, about what I would expect. Running Grype against it reports a bunch of possible vulnerabilities. Can you explain in more detail the problem on the Syft side here? I am not familiar with Blackduck's scanning software and you might need to contact them for information about their tool. Thanks!

[Naranthiran]

Hi Tim,

Thanks for your response.
While importing the SBOM in the Blackduck I found only 58 components out of 650.
I wanted to check with you, if the way I create the SBOM with its parameters is correct or if I am missing something.

From the BlackDuck side, I understand that the package name and referenceLocator files were not matching.

Regards
Naranthiran Duraisamy

[tgerla]

Hi Naranthiran, as far as I can tell, your method of calling Syft is fine, and I don't see anything out of the ordinary in the generated SBOM. It does look like Blackduck is expecting something different. It might be some sort of incompatibility between the tools but we would be happy to look. Would you be able to contact Blackduck and open a support ticket there? We would be happy to explore the problem. Thanks,

Tim