Why SBOM contains configuration files?

General
1

Hi All,

I have tried generating SBOM with syft 1.32 version, i see it contains even configuration files, SBOM should contain only components and dependencies rite ? Adding screenshot for reference.

In earlier versions i have not seen, is this introduced newly ?

Thanks in advance, Anvitha

image
image652×217 6.79 KB

2

Hi @anvitha_haviligi,

Thanks for the question!

Can you tell me more about what this is a screenshot of? What format did you ask Syft for, and what program are you using to view it?

In general, Syft SBOMs contain packages, files, and metadata about which packages own which files. Is this causing some sort of difficulty?

3

Out of curiosity, I ran syft on alpine:latest for every format, and found “/etc/apk/keys*” in two formats, syft-json and cyclonedx-xml, and they’re in the alpine-keys package.

pkg:apk/alpine/alpine-keys@2.5-r0?arch=aarch64&distro=alpine-3.22.1"

e.g.

         {
            "path": "/etc/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
            "digest": {
              "algorithm": "'Q1'+base64(sha1)",
              "value": "Q1BTqS+H/UUyhQuzHwiBl47+BTKuU="
            }
          },

Dunno if this is helpful, but my curiosity has been satiated.

4

Command Used : syft scan -o cyclonedx-json@1.5

In below output, it even shows zoneinfo which is not useful i feel.

{
“bom-ref”: “b9e0f43950d00ad3”,
“type”: “file”,
“name”: “/usr/share/zoneinfo/Africa/Addis_Ababa”,
“hashes”: [
{
“alg”: “SHA-1”,
“content”: “289d1fb5a419107bc1d23a84a9e06ad3f9ee8403”
},
{
“alg”: “SHA-256”,
“content”: “c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968”
}
]
},
{
“bom-ref”: “ba9f54bbc89ac30d”,
“type”: “file”,
“name”: “/usr/share/zoneinfo/Africa/Algiers”,
“hashes”: [
{
“alg”: “SHA-1”,
“content”: “edb95d3dc9238b5545f4f1d85d8bc879cdacdec8”
},
{
“alg”: “SHA-256”,
“content”: “bda1698cd542c0e6e76dfbbcdab390cdd26f37a9d5826a57a50d5aab37f3b2a6”

5

By default, Syft will find files that are owned by a package it finds. So if apk or rpm or whatever have written down that a package owns a file, Syft will report that package.

You can set SYFT_FILE_METADATA_SELECTION=none in the environment to make Syft not do this if you don’t find it useful.

6

Thanks @willmurphy , I will try this option