PURL for kata-containers

Syft
1

Hi Team,
I am building kata-containers rust-based binaries using cargo-auditable. One of these binaries is container-shim-kata-v2 which when built with cargo-auditable embeds .dep-v0 ELF section.

When I run syft with the binary, it results in below PURLs

pkg:cargo/shim@0.1.0
pkg:cargo/runtime-rs@0.1.0

However, the CVEs of kata-containers OSV - Open Source Vulnerabilities are associated with the Github PURLs.

Our limitation is that we can identify vulnerabilities only using PURLs.

Is there a way we can embed and detect Github PURL from the rust binary?

2

Hi @dk_g,

Just so I understand, you’re looking to scan with Syft, get an SBOM with the github-based PURL and then scan yourself using something other than Grype?

Since cargo-auditable is describing Cargo packages, I think the cargo PURLs make the most sense from a Syft perspective. Is this something that OSV might be able to include multiple packages spanning both ecosystems in the affected section? If we were talking about Grype, the OSV github ecosystem wouldn’t be included today anyway, but we might think about adding some aliases if we did include these records in the future.