Collect Mariner/Azurelinux packages in container scan

[pombredanne]

See https://packages.microsoft.com/cbl-mariner/2.0/prod/base/x86_64/Packages/
(And https://packages.microsoft.com/cbl-mariner/)

This is an RPM distro mostly used in containers @ Azure. We are already finding installed packages in SCIO container scans.

See also these related issues:

• Collect Mariner vulnerabilities  vulnerablecode#751
• Add support for cgmanifest scancode-toolkit#3060
• Index Mariner RPM packages  purldb#383

[pombredanne]

These are distroless-like images with minimal package metadata:

• /var/lib/rpmmanifest/container-manifest-1 and /var/lib/rpmmanifest/container-manifest-2 contain installed RPM data (to get very basic metadata)

• /var/cache/tdnf/mariner-local-repo-xxxxx seems to contain the index of installed RPMs (to get the list of installed files?)

• See https://github.com/microsoft/marinara/blob/main/scripts/marinaracommon.py for how these images are built. Packages are installed from their RPMS repo ay https://packages.microsoft.com/cbl-mariner/ using tdnf https://github.com/vmware/tdnf/

• /usr/share/licenses/<package>/.... has license files, as in /usr/share/licenses/openssl/LICENSE

[pombredanne]

See https://mcr.microsoft.com/en-us/product/cbl-mariner/base/core/about for test images

[AyanSinhaMahapatra]

There are two kinds of mariner:

• base: https://mcr.microsoft.com/en-us/product/cbl-mariner/base/core/about
• marinara: this is base with python and a couple other things? docker://mcr.microsoft.com/cbl-mariner/marinara:2.0
• distroless: https://mcr.microsoft.com/en-us/product/cbl-mariner/distroless/base/

It seems only the distroless one here has the properties mentioned in #1156 (comment), otherwise the base images have a /var/lib/rpm/rpmdb.sqlite and we can create packages out of it once mariner is included in the list of accepted distros. But we do not assign resources to packages correctly here btw.

Note that the /usr/share/licenses directory is present for both.