This is a simple replication of the SBOM (Software Bill of Materials) issues we are facing when building using bazel
In this setup we are trying to build a simple go application with
UUID:1.6.0
package with checksumh1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
Even though the package is simple, there are quiet a few differences in SBOM
I have put the diff in here
You can checkout the SBOMs generated by Syft in
- ./sbom-bazel-build.json
- ./sbom-go-build.json
- Install the scanners - syft/trivy
- Create images - 1 built with Go and 1 with bazel - Sample app and Docker images available in this repo!
- Run the scans for the 2 images(Commands)!
Syft - syft <your-docker-image> -o json
Trivy - trivy image --format cyclonedx <your-docker-image>
- Compare the diff here