Trivy scan of go binary produces invalid sbom

[candrews]

Description

The CycloneDX sbom produced by Trivy for (at least some) go binaries is invalid. It expresses a dependency on pkg:/ which doesn't make sense. When Trivy itself tries to scan this sbom (using trivy sbom) it fails with an error.

Desired Behavior

The sbom produced by trivy image --format cyclonedx should only contain valid dependencies (and not pkg:/).

Actual Behavior

A few excerpts of the sbom:

  "dependencies": [
    {
      "ref": "376b172d-68c1-4d8a-99a2-2d2612bd3b7c",
      "dependsOn": [
        "pkg:/",
        "pkg:golang/cloud.google.com/go/compute/[email protected]",
        "pkg:golang/cloud.google.com/go/[email protected]",
        "pkg:golang/cloud.google.com/go/[email protected]",

    {
      "ref": "pkg:/",
      "dependsOn": []
    },

debug.txt

Reproduction Steps

1. `docker run -it aquasec/trivy:0.46.0 --format cyclonedx image fluxcd/kustomize-controller:v0.35.0`
2. Look at the output for `"pkg:/"`

Target

Container Image

Scanner

Vulnerability

Output Format

CycloneDX

Mode

Standalone

Debug Output

debug.txt

Operating System

Linux

Version

$ docker run -it aquasec/trivy:0.46.0 --version
Version: 0.46.0

### Checklist

- [X] Run `trivy image --reset`
- [X] Read [the troubleshooting](https://aquasecurity.github.io/trivy/latest/docs/references/troubleshooting/)

[DmitriyLewen]

Hello @candrews
Thanks for your report!

It looks like we have incorrectly identified package from your binary.
Can you share your binary to investigate this issue.

Regards, Dmitriy

[candrews]

Here's usr/local/bin/kustomize-controller that I extracted from the fluxcd/kustomize-controller:v0.35.0 image: https://filebin.net/r3xd5wazu5srgwtb

I had to use a different service as the file, even when gzip'ed, is larger than GitHub file attachment size limit.

[DmitriyLewen]

image is even better.
Thanks. I will investigate this and write to you.

[DmitriyLewen]

Hello @candrews
Thanks for your report!

Created #5449 for this issue.