Cyclonedx exports with components with empty names (bitnami images)

[benni-as]

Description

We are tracking our dependencies with dependency track and trivy-operator. Lately, I have noticed, that we can't upload bitnami SBOM Reports to depependency track becauase of the following error: "schema validation failed ... required property name not found".

After further investgation I could reproduce the behaviour with manually creating an cyclonedx output of the nginx bitnami image:

trivy image --format cyclonedx --output bitnami-nginx-cyclonedx.json docker.io/bitnami/nginx
....

jq ".components[] | select(.name == \"\")" bitnami-nginx-cyclonedx.json
{
  "bom-ref": "6347d498-dd28-4661-84e3-fddbd65607d0",
  "type": "application",
  "name": "",
  "properties": [
    {
      "name": "aquasecurity:trivy:Class",
      "value": "lang-pkgs"
    },
    {
      "name": "aquasecurity:trivy:Type",
      "value": "gobinary"
    }
  ]
}

Maybe this issues is similar to #6693

Desired Behavior

Cyclonedx outputs should not contain components without the name key or an emtpy name.

Actual Behavior

SBOM Reports contain invalid components.

Reproduction Steps

Please see Description.

Target

Container Image

Scanner

None

Output Format

CycloneDX

Mode

Standalone

Debug Output

trivy image --format cyclonedx --output bitnami-nginx-cyclonedx.json docker.io/bitnami/nginx --debug
2025-02-28T15:37:15+01:00	DEBUG	No plugins loaded
2025-02-28T15:37:15+01:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-02-28T15:37:15+01:00	DEBUG	Cache dir	dir="/home/benni/.cache/trivy"
2025-02-28T15:37:15+01:00	DEBUG	Cache dir	dir="/home/benni/.cache/trivy"
2025-02-28T15:37:15+01:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-02-28T15:37:15+01:00	DEBUG	Ignore statuses	statuses=[]
2025-02-28T15:37:15+01:00	INFO	"--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "cyclonedx" report.
2025-02-28T15:37:15+01:00	DEBUG	[pkg] Package types	types=[os library]
2025-02-28T15:37:15+01:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-02-28T15:37:15+01:00	DEBUG	Initializing scan cache...	type="fs"
2025-02-28T15:37:16+01:00	DEBUG	[image] Detected image ID	image_id="sha256:54d342ace3c9d59ab70bccdc4af0eccf1f51b95b42c8cf3181098608edadcb01"
2025-02-28T15:37:16+01:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:317f8ea4d3b58826376ab4b1c1a429fec58e22a98903df8d7c82d095fcafd3dd]
2025-02-28T15:37:16+01:00	DEBUG	[image] Detected base layers	diff_ids=[]
2025-02-28T15:37:16+01:00	INFO	Detected OS	family="debian" version="12.9"
2025-02-28T15:37:16+01:00	INFO	Number of language-specific files	num=4
2025-02-28T15:37:16+01:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-02-28T15:37:16+01:00	DEBUG	[vex] VEX filtering is disabled

Operating System

Arch linux

Version

Version: 0.59.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-02-06 12:17:55.758424452 +0000 UTC
  NextUpdate: 2025-02-07 12:17:55.758424192 +0000 UTC
  DownloadedAt: 2025-02-06 15:23:35.064560634 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-02-28 04:39:05.56359648 +0000 UTC
  NextUpdate: 2025-03-03 04:39:05.56359628 +0000 UTC
  DownloadedAt: 2025-02-28 14:22:34.527479335 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

duplicate of #8189