SBOM files for some artifacts are almost empty

[jpkrohling]

We have SBOMs since v0.95.0, but some artifacts seem to be missing the actual contents of the package, like the one for otelcol-contrib_0.95.0_darwin_amd64.tar.gz.sbom:

{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "otelcol-contrib_0.95.0_darwin_amd64.tar.gz",
  "documentNamespace": "https://anchore.com/syft/file/otelcol-contrib_0.95.0_darwin_amd64.tar.gz-2e3641ac-13d0-4b31-a9f2-025169cf944c",
  "creationInfo":
    {
      "licenseListVersion": "3.22",
      "creators": ["Organization: Anchore, Inc", "Tool: syft-0.103.1"],
      "created": "2024-02-21T16:25:34Z",
    },
  "packages":
    [
      {
        "name": "otelcol-contrib_0.95.0_darwin_amd64.tar.gz",
        "SPDXID": "SPDXRef-DocumentRoot-File-otelcol-contrib-0.95.0-darwin-amd64.tar.gz",
        "versionInfo": "sha256:d380af1301fd318be75af009543cb7abeb1aca8ce12dd25f60529085a7c6417f",
        "supplier": "NOASSERTION",
        "downloadLocation": "NOASSERTION",
        "filesAnalyzed": false,
        "checksums":
          [
            {
              "algorithm": "SHA256",
              "checksumValue": "d380af1301fd318be75af009543cb7abeb1aca8ce12dd25f60529085a7c6417f",
            },
          ],
        "primaryPackagePurpose": "FILE",
      },
    ],
  "relationships":
    [
      {
        "spdxElementId": "SPDXRef-DOCUMENT",
        "relatedSpdxElement": "SPDXRef-DocumentRoot-File-otelcol-contrib-0.95.0-darwin-amd64.tar.gz",
        "relationshipType": "DESCRIBES",
      },
    ],
}

Some other entries, like otelcol_0.95.0_windows_amd64.tar.gz.sbom , seem to have an appropriate content, containing things like:

        {
            "name": "golang.org/x/oauth2",
            "SPDXID": "SPDXRef-Package-go-module-golang.org-x-oauth2-80fd63a362642b94",
            "versionInfo": "v0.16.0",
            "supplier": "NOASSERTION",
            "downloadLocation": "NOASSERTION",
            "filesAnalyzed": false,
            "checksums": [
                {
                    "algorithm": "SHA256",
                    "checksumValue": "683906301498c4495aa0ff35369a14a33da8a36476c07759a464e85317f242b4"
                }
            ],
            "sourceInfo": "acquired package info from go module information: otelcol.exe",
            "licenseConcluded": "NOASSERTION",
            "licenseDeclared": "NOASSERTION",
            "copyrightText": "NOASSERTION",
            "externalRefs": [
                {
                    "referenceCategory": "SECURITY",
                    "referenceType": "cpe23Type",
                    "referenceLocator": "cpe:2.3:a:golang:x\\/oauth2:v0.16.0:*:*:*:*:*:*:*"
                },
                {
                    "referenceCategory": "PACKAGE-MANAGER",
                    "referenceType": "purl",
                    "referenceLocator": "pkg:golang/golang.org/x/oauth2@v0.16.0"
                }
            ]
        },

We need to investigate what's the difference, and how we can get the packages to be like the SBOMs for Windows.

[jpkrohling]

@cpanato, do you have an idea on what's going on?

@cartersocha, this is the issue we talked about during the SIG Security call.

[cpanato]

hum looks like it is doing working well with the .tar.gz, i think that is better only with the binary, i can change that

[cpanato]

seems we need to pass some config options

run locally (with the correct version now)

 syft scan otelcol-contrib_0.98.0_darwin_amd64.tar.gz -o spdx-json                                                                                                                                                                                                                                                                                                                                                                                                                                         ✔ Indexed file system                                                                                                                                                                                                                                                                                                                                                                                          /private/var/folders/kl/q9mydw095ln5s7wj971qcrx40000gn/T/syft-archive-contents-177865781   ✔ Cataloged contents                                                                                                                                                                                                                                                                                                                                                                                                                   f2d873bf5f6127ce965934c5ee10665f83195ae3264690a496e63b895f996567     ├── ✔ Packages                        [675 packages]                                                                                                                                                                                                                                                                                                                                                                                                                                                      └── ✔ Executables                     [1 executables]
{"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","SPDXID":"SPDXRef-DOCUMENT","name":"otelcol-contrib_0.98.0_darwin_amd64.tar.gz","documentNamespace":"https://anchore.com/syft/file/otelcol-contrib_0.98.0_darwin_amd64.tar.gz-0605e1c6-a055-45ad-bb22-611d8ad283b8","creationInfo":{"licenseListVersion":"3.23","creators":["Organization: Anchore, Inc","Tool: syft-1.1.1"],"created":"2024-04-12T08:27:15Z"},"packages":[{"name":"bitbucket.org/atlassian/go-asap/v2","SPDXID":"SPDXRef-Package-go-mod
ule-bitbucket.org-atlassian-go-asap-v2-249ebae86b40f5df","versionInfo":"v2.8.0","supplier":"NOASSERTION","downloadLocation":"NOASSERTION","filesAnalyzed":false,"checksums":[{"algorithm":"SHA256","checksumValue":"24be2392dad94f71fc187924789d5109d849e5870ec9571c03fd9327869edc8d"}],"sourceInfo":"acquired package info from go module information: otelcol-contrib","licenseConcluded":"NOASSERTION","licenseDeclared":"NOASSERTION","copyrightText":"NOASSERTION","externalRefs":[{"referenceCategor
y":"SECURITY","referenceType":"cpe23Type","referenceLocator":"cpe:2.3:a:atlassian:go-asap\\/v2:v2.8.0:*:*:*:*:*:*:*"},{"referenceCategory":"SECURITY","referenceType":"cpe23Type","referenceLocator":"cpe:2.3:a:atlassian:go_asap\\/v2:v2.8.0:*:*:*:*:*:*:*"},{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:golang/bitbucket.org/atlassian/go-asap@v2.8.0#v2"}]},{"name":"cloud.google.com/go","SPDXID":"SPDXRef-Package-go-module-cloud.google.com-go-c5a7793790f
1ea74","versionInfo":"v0.112.2","supplier":"NOASSERTION","downloadLocation":"NOASSERTION","filesAnalyzed":false,"checksums":[{"algorithm":"SHA256","checksumValue":"65a193e8b886edd0738baccd3af559c1a71a5e599fde546a9c2e03433ab2450c"}],"sourceInfo":"acquired package info from go module information: otelcol-contrib","licenseConcluded":"NOASSERTION","licenseDeclared":"NOASSERTION","copyrightText":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","ref
erenceLocator":"pkg:golang/cloud.google.com/go@v0.112.2"}]},{"name":"cloud.google.com/go/compute/metadata","SPDXID":"SPDXRef-Package-go-module-cloud.google.com-go-compute-metadata-e4175b7b6cf1e683","versionInfo":"v0.2.4-0.20230617002413-005d2dfb6b68","supplier":"NOASSERTION","downloadLocation":"NOASSERTION","filesAnalyzed":false,"checksums":[{"algorithm":"SHA256","checksumValue":"69156a635a76209681192b5632c40ca6401af3770f9020cb97cd1e3a3d116f3e"}],"sourceInfo":"acquired package info fro
m go module information: otelcol-contrib","licenseConc
...

[cpanato]

i run the gorelease locally and the sboms was created with data

[cpanato]

we need to make sure we have the latest syft, checking that

[cpanato]

seems ok

was able to reproduce the issue with syft v1.1.0 with v1.1.1 was ok

[cpanato]

we need to wait for anchore/sbom-action#456

[jpkrohling]

Thank you for the investigation!