[tembleking]

Summary

Recent sysdig-cli-scanner versions report every SBOM component in the JSON v1 output, not only software packages. That includes standalone applications such as an embedded web server or a monitoring tool. Vulnerabilities can also be identified by advisory IDs other than CVEs, such as GHSA-…. The plugin now handles both, and its dependencies and default scanner version are updated.

What changes

Applications and other SBOM components

• Applications are recognized as such instead of being reported as packages of type Unknown. The vulnerability report and the image diff show their type (e.g. "Web Server") and their path.
• The domain model gains a Component abstraction with three implementations:
  • Package: a software package, with a PackageType.
  • Application: has a free-text type.
  • ImageComponent: the operating system or the container image, with no layer.
• Vulnerabilities, accepted risks, layers and policy failures relate to components, so findings and policy failures on an application are reported like package ones.
• Output from older scanners, which have no category field, and categories without a dedicated kind are still parsed as packages.

Non-CVE vulnerability IDs

• disclosureDate is optional in the JSON v1 contract, but it was parsed unconditionally, so a vulnerability without it made the whole report fail to parse. It is now optional, and the report shows an empty publish date.
• GHSA advisories link to GitHub Advisories, and CVEs keep linking to NVD.
• In the image diff tables, vulnerability IDs no longer wrap at each hyphen.

Dependencies

• Parent POM 6.2236.v12dd4c483242, Jenkins BOM 7169.vb_32a_cfd93fa_6, and updated Nix flake inputs.
• The default sysdig-cli-scanner is now 1.30.2. The oldest supported stays 1.23.0.
• The recorded scanner fixtures now use grafana/grafana:9.5.21, which contains an application, Go modules and OS packages.

Testing

• just verify passes.
• Real scanner fixtures from the newest (1.30.2) and oldest (1.23.0) supported versions, with and without component categories.
• New ComponentTest for the relationships of applications and image components, including policy failures on an application.
• Hand-crafted fixture with a GHSA advisory that has no disclosure date and is referenced by a policy failure.
• Manual UI check with mvn hpi:run and real scans of grafana/grafana:9.5.21, grafana/grafana:10.0.0 (using imageToCompare) and httpd:2.4.49-alpine:
  • The Policy, Security and Diff tabs render application findings with their type and path.
  • Policy failures on an application are listed like package ones.
  • A GHSA ID links to GitHub Advisories, and a missing publish date renders as an empty cell.

Notes for reviewers

• The scan result is not persisted (SysdigAction only stores strings), so moving from Package-based APIs to Component has no impact on existing builds.
• Vulnerability.cve(), findVulnerabilityByCVE() and the "CVE ID" column keep their names even though they can now hold other advisory IDs. Renaming them would also touch the UI, which looks the column up by its title, so it is left for a follow-up.
• Pre-existing and out of scope: the report page logs Cannot read properties of null (reading 'rows'). index.jelly never sets data-gates-summary-table, and index-script.js only compares it with '', so it calls JSON.parse(null). The rendered tables are not affected.