Add filesystem SBOM support for container scans (#42)

* Add filesystem SBOM support for container scans

* added trivy removal and correct workdir mapping

* fix to address the Ubuntu 22.04 glibc mismatch for the PyInstaller native binary

---------

Co-authored-by: Ishaan Jain <ishaanj18@Ishaans-MacBook-Air.local>

Author: Ishaanj18

.github/workflows/release.yml

@@ -44,7 +44,9 @@ jobs:
     strategy:
       matrix:
         include:
-          - os: ubuntu-latest
+          # Build on the oldest common target to avoid glibc mismatches on customer hosts.
+          # Customers reported GLIBC_2.38 is required by the binary, but Ubuntu 22.04 ships an older glibc.
+          - os: ubuntu-22.04
             name: linux
             suffix: ''
             ext: ''
@@ -97,15 +99,15 @@ jobs:
             dist/accuknox-aspm-scanner${{ matrix.ext }}
 
       - name: Upload Ubuntu Native Binary Artifact
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-22.04'
         uses: actions/upload-artifact@v4
         with:
           name: native-binary-linux
           retention-days: 1
           path: dist/accuknox-aspm-scanner
 
       - name: Flag Ubuntu completion
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-22.04'
         id: set-output-ubuntu
         run: echo "ready=true" >> $GITHUB_OUTPUT
 

aspm_cli/commands/scan_command.py

@@ -10,6 +10,7 @@
 from aspm_cli.utils.config import ConfigValidator
 from aspm_cli.utils.common import upload_results, handle_failure, ALLOWED_SCAN_TYPES
 from aspm_cli.utils.git_info import GitInfo
+from aspm_cli.utils.sbom import derive_sbom_classifier, enrich_sbom_payload, resolve_project_name
 
 class ScanCommand(BaseCommand):
     help_text = f"Run a security scan (e.g. {', '.join(ALLOWED_SCAN_TYPES)})"
@@ -48,8 +49,7 @@ def execute(self, args):
                 "accuknox_label": args.label or os.getenv("ACCUKNOX_LABEL"),
                 "accuknox_token": args.token or os.getenv("ACCUKNOX_TOKEN"),
                 "accuknox_tenant": args.tenant or os.getenv("ACCUKNOX_TENANT"),
-                "accuknox_project_name": args.project_name
-                or os.getenv("ACCUKNOX_PROJECT"),
+                "accuknox_project_name": resolve_project_name(args.project_name),
             }
 
             # Get the correct scanner strategy from the registry
@@ -85,20 +85,25 @@ def execute(self, args):
                 # If this is an SBOM upload, enrich the SBOM file with project_name and classifier
                 if is_sbom_upload:
                     project_name = accuknox_config.get("accuknox_project_name")
+                    scan_command = getattr(args, "command", "") or ""
+                    project_classifier = derive_sbom_classifier(scan_command)
                     try:
                         with open(result_file, "r", encoding="utf-8") as f:
                             data = json.load(f)
 
                         if isinstance(data, dict):
-                            if project_name:
-                                data["project_name"] = project_name
-                            data["project_classifier"] = "container"
+                            enrich_sbom_payload(
+                                data,
+                                scan_command,
+                                project_name,
+                                project_classifier,
+                            )
 
                             with open(result_file, "w", encoding="utf-8") as f:
                                 json.dump(data, f, indent=2)
                     except Exception as e:
                         Logger.get_logger().debug(
-                            f"Failed to enrich SBOM results.json with project_name/classifier: {e}"
+                            f"Failed to enrich SBOM results.json: {e}"
                         )
 
                 # Upload if not skipping

aspm_cli/scan/container.py

@@ -1,11 +1,13 @@
 import subprocess
 import json
 import os
+import re
 import shlex
 from aspm_cli.tool.manager import ToolManager
 from aspm_cli.utils.logger import Logger
 from aspm_cli.utils import docker_pull
 from aspm_cli.utils import config
+from aspm_cli.utils.sbom import normalize_sbom_args_for_docker
 from colorama import Fore
 
 class ContainerScanner:
@@ -25,17 +27,32 @@ def run(self):
             severity_threshold, sanitized_args = self._build_container_scan_args()
             scan_cmd = self._build_scan_command(sanitized_args)
 
-            Logger.get_logger().debug(f"Scanning container image: {' '.join(scan_cmd)}")
+            log_msg = (
+                "Running container SBOM scan"
+                if self.generate_sbom
+                else "Scanning container image"
+            )
+            Logger.get_logger().debug(f"{log_msg}: {' '.join(scan_cmd)}")
             result = subprocess.run(scan_cmd, capture_output=True, text=True)
 
             if result.stdout:
-                sanitized_stdout = result.stdout.replace("trivy", "[scanner]")
+                sanitized_stdout = re.sub(
+                    r"trivy|aquasecurity|aqua security",
+                    "[scanner]",
+                    result.stdout,
+                    flags=re.IGNORECASE,
+                )
                 Logger.get_logger().debug(sanitized_stdout)
                 if("--help" in self.command):
                     Logger.log_with_color('INFO', sanitized_stdout, Fore.WHITE)
                     return config.PASS_RETURN_CODE, None
             if result.stderr:
-                sanitized_stderr = result.stderr.replace("trivy", "[scanner]")
+                sanitized_stderr = re.sub(
+                    r"trivy|aquasecurity|aqua security",
+                    "[scanner]",
+                    result.stderr,
+                    flags=re.IGNORECASE,
+                )
                 Logger.get_logger().error(sanitized_stderr)
 
             if self.generate_sbom:
@@ -79,6 +96,10 @@ def _build_container_scan_args(self):
                 i += 1
             # Force cyclonedx format and JSON output
             sanitized_args.extend(["-f", "cyclonedx", "-o", self.result_file])
+            if self.container_mode:
+                sanitized_args = normalize_sbom_args_for_docker(
+                    self.command or "", sanitized_args
+                )
             return None, sanitized_args
 
         # Flags that take a value and should be removed.

aspm_cli/scanners/container_scanner.py

@@ -4,15 +4,18 @@
 from aspm_cli.scan.container import ContainerScanner as OriginalContainerScanner
 
 class ContainerScanner(BaseScanner):
-    help_text = "Run a container image scan using Trivy"
+    help_text = "Run a container image or filesystem SBOM scan"
     data_type_identifier = "TR"
 
     def add_arguments(self, parser: argparse.ArgumentParser):
         parser.add_argument(
             "--command",
             type=str,
             required=True,
-            help="Arguments to pass to the container scanner (e.g., 'image nginx:latest')"
+            help=(
+                "Scanner arguments (e.g. 'image nginx:latest' for image SBOM/vuln scan; "
+                "'filesystem .' for repo SBOM with --generate-sbom)"
+            )
         )
         parser.add_argument(
             "--container-mode",
@@ -26,7 +29,11 @@ def add_arguments(self, parser: argparse.ArgumentParser):
         )
 
     def validate_config(self, args: argparse.Namespace, validator: ConfigValidator):
-        validator.validate_container_scan(args.command, args.container_mode)
+        validator.validate_container_scan(
+            args.command,
+            args.container_mode,
+            generate_sbom=getattr(args, "generate_sbom", False),
+        )
 
     def run_scan(self, args: argparse.Namespace) -> tuple[int, str]:
         # Instantiate and run the original scanner logic

aspm_cli/utils/config.py

@@ -3,6 +3,7 @@
 from typing import Optional, Literal
 from aspm_cli.utils.logger import Logger
 from aspm_cli.utils.common import ALLOWED_SCAN_TYPES
+from aspm_cli.utils.sbom import validate_sbom_command
 
 # Return code constants
 PASS_RETURN_CODE = 0
@@ -159,19 +160,34 @@ class SecretScanConfig(BaseModel):
             Logger.get_logger().debug(f"Secret scan configuration error: {concise_msg}")
             raise ValueError(concise_msg)
 
-    def validate_container_scan(self, command: str, container_mode: bool):
+    def validate_container_scan(
+        self,
+        command: str,
+        container_mode: bool,
+        generate_sbom: bool = False,
+    ):
         class ContainerScanConfig(BaseModel):
             command: str = Field(..., min_length=1, description="Command arguments for Container scanner")
             container_mode: bool
 
         try:
             ContainerScanConfig(command=command, container_mode=container_mode)
-            self._log_validation_success("Container")
         except ValidationError as e:
             concise_msg = _format_validation_error(e)
             Logger.get_logger().debug(f"Container scan configuration error: {concise_msg}")
             raise ValueError(concise_msg)
 
+        if generate_sbom:
+            validate_sbom_command(command)
+            if not self.skip_upload and not self.accuknox_config.accuknox_project_name:
+                raise ValueError(
+                    "AccuKnox project name is required for SBOM uploads. "
+                    "Provide --project-name or set ACCUKNOX_PROJECT_NAME (or legacy ACCUKNOX_PROJECT), "
+                    "or use --skip-upload if you only need a local SBOM file."
+                )
+
+        self._log_validation_success("Container")
+
     def validate_sast_scan(self, command: str, container_mode: bool, severity: str, repo_url: Optional[str], commit_ref: Optional[str], commit_sha: Optional[str], pipeline_id: Optional[str], job_url: Optional[str]):
         class SASTScanConfig(BaseModel):
             command: str = Field(..., min_length=1, description="Command arguments for SAST scanner")