Missing python packages

[javierfreire]

Description

Trivy detects a little subset of the python packages present in an image.

Desired Behavior

Trivy detects all the python packages.

Actual Behavior

[email protected] detects 524 packages, but [email protected] only detects 10 packages.

Reproduction Steps

1. [email protected] detects 10 packages.

$ trivy image bitnami/airflow --db-repository "public.ecr.aws/aquasecurity/trivy-db" --format spdx-json | grep pkg:pypi | wc -l

2024-10-31T16:27:03+01:00	INFO	Adding schema version to the DB repository for backward compatibility	repository="public.ecr.aws/aquasecurity/trivy-db:2"
2024-10-31T16:27:03+01:00	INFO	"--format spdx-json" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "spdx-json" report.
2024-10-31T16:27:04+01:00	INFO	Detected OS	family="debian" version="12.7"
2024-10-31T16:27:04+01:00	INFO	Number of language-specific files	num=8
10

2. [email protected] detects 524 packages.

$ trivy image bitnami/airflow --db-repository "public.ecr.aws/aquasecurity/trivy-db" --format spdx-json | grep pkg:pypi | wc -l

2024-10-31T16:29:25+01:00	INFO	Adding schema version to the DB repository for backward compatibility	repository="public.ecr.aws/aquasecurity/trivy-db:2"
2024-10-31T16:29:25+01:00	INFO	"--format spdx-json" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "spdx-json" report.
2024-10-31T16:29:27+01:00	INFO	Detected OS	family="debian" version="12.7"
2024-10-31T16:29:27+01:00	INFO	Number of language-specific files	num=8
423

Target

None

Scanner

None

Output Format

SPDX

Mode

None

Debug Output

$ trivy image bitnami/airflow --db-repository "public.ecr.aws/aquasecurity/trivy-db" --format spdx-json --debug

2024-10-31T16:34:20+01:00	DEBUG	No plugins loaded
2024-10-31T16:34:20+01:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2024-10-31T16:34:20+01:00	DEBUG	Cache dir	dir="/home/fjavier/.cache/trivy"
2024-10-31T16:34:20+01:00	DEBUG	Cache dir	dir="/home/fjavier/.cache/trivy"
2024-10-31T16:34:20+01:00	INFO	Adding schema version to the DB repository for backward compatibility	repository="public.ecr.aws/aquasecurity/trivy-db:2"
2024-10-31T16:34:20+01:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-10-31T16:34:20+01:00	DEBUG	Ignore statuses	statuses=[]
2024-10-31T16:34:20+01:00	INFO	"--format spdx-json" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the "spdx-json" report.
2024-10-31T16:34:20+01:00	DEBUG	[pkg] Package types	types=[os library]
2024-10-31T16:34:20+01:00	DEBUG	[pkg] Package relationships	relationships=[unknown root direct indirect]
2024-10-31T16:34:20+01:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-10-31T16:34:20+01:00	DEBUG	Initializing scan cache...	type="fs"
2024-10-31T16:34:22+01:00	DEBUG	[image] Detected image ID	image_id="sha256:93659122dfa0bc1f63926f7c1077b80c6df07ba092ef56c1668b3847441c4ea6"
2024-10-31T16:34:22+01:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:c4dd6d1db82ccb120c512385f1f80b521b9e57debf131b927b446458d9c7747d]
2024-10-31T16:34:22+01:00	DEBUG	[image] Detected base layers	diff_ids=[]
2024-10-31T16:34:22+01:00	INFO	Detected OS	family="debian" version="12.7"
2024-10-31T16:34:22+01:00	INFO	Number of language-specific files	num=8
2024-10-31T16:34:22+01:00	DEBUG	[vex] VEX filtering is disabled

Operating System

Ubuntu 23.04

Version

Version: 0.56.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-10-31 12:18:45.919223417 +0000 UTC
  NextUpdate: 2024-11-01 12:18:45.919223277 +0000 UTC
  DownloadedAt: 2024-10-31 13:05:54.329654087 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @javierfreire
Thanks for your report!

Created #7851 for this issue.

Regards, Dmitriy