Support for Fedora CoreOS 36 -> OKD/OpenShift about grype

[wagoodman]

I tried using syft within fedora core 40 to scan itself and was able to get a listing of installed RPMs that are in /usr/share/rpm/rpmdb.sqlite (I'm speaking relative to syft rather than grype since the mechanism you're referring to is about package identification and really resides in syft... and grype leverages that functionality from syft).

I take it you are looking for additional functionality here? I'm not well versed in fedora core, but from what I understand the underlying filesystem is immutable (or a portion of it), thus, installing RPMs and modifying the RPM DB is no longer allowed. It appears that rpm-ostree install <pkg> is what is used to now to add packages to the system, but I think I'm lacking some fundamental knowledge since this is failing for me.

Can you confirm that you are looking for additional cataloging capabilities beyond what is available in the RPM DB (/usr/share/rpm/rpmdb.sqlite)? (and if so, can you elaborate on the specifics?)

[lokcio]

Hi,
Below I paste the SBOM from master-OKD (fedora core 39)

and the result of the rpm -qa command and, to be sure.

My diagnosis was that sygnaurty/grype doesn't recognize packages correctly it doesn't report any vulnerability found which sounds very unlikely. Hence the ticket to daod support for this system.

sbom_syft-json_11_0_1-okd-master0-1716277638.json.gz

core@master0:~$ rpm -qa
libgcc-13.2.1-6.fc39.x86_64
linux-firmware-whence-20240115-2.fc39.noarch
crypto-policies-20231204-1.git1e3a2e4.fc39.noarch
tzdata-2024a-2.fc39.noarch
fuse-common-3.16.1-1.fc39.x86_64
fedora-release-identity-coreos-39-34.noarch
fedora-gpg-keys-39-1.noarch
fedora-repos-39-1.noarch
fedora-release-common-39-34.noarch
fedora-release-coreos-39-34.noarch
setup-2.14.4-1.fc39.noarch
filesystem-3.18-6.fc39.x86_64
efi-filesystem-5-9.fc39.noarch
basesystem-11-18.fc39.noarch
amd-gpu-firmware-20240115-2.fc39.noarch
amd-ucode-firmware-20240115-2.fc39.noarch
atheros-firmware-20240115-2.fc39.noarch
brcmfmac-firmware-20240115-2.fc39.noarch
cirrus-audio-firmware-20240115-2.fc39.noarch
intel-audio-firmware-20240115-2.fc39.noarch
intel-gpu-firmware-20240115-2.fc39.noarch
mt7xxx-firmware-20240115-2.fc39.noarch
nvidia-gpu-firmware-20240115-2.fc39.noarch
nxpwireless-firmware-20240115-2.fc39.noarch
realtek-firmware-20240115-2.fc39.noarch
tiwilink-firmware-20240115-2.fc39.noarch
linux-firmware-20240115-2.fc39.noarch
vim-data-9.1.031-1.fc39.noarch
publicsuffix-list-dafsa-20240107-1.fc39.noarch
pkgconf-m4-1.9.5-2.fc39.noarch
pcre2-syntax-10.42-1.fc39.2.noarch
ncurses-base-6.4-7.20230520.fc39.noarch
glibc-gconv-extra-2.38-16.fc39.x86_64
glibc-minimal-langpack-2.38-16.fc39.x86_64
glibc-common-2.38-16.fc39.x86_64
glibc-2.38-16.fc39.x86_64
ncurses-libs-6.4-7.20230520.fc39.x86_64
bash-5.2.26-1.fc39.x86_64
zlib-1.2.13-4.fc39.x86_64
xz-libs-5.4.4-1.fc39.x86_64
popt-1.19-3.fc39.x86_64
libzstd-1.5.5-4.fc39.x86_64
libcom_err-1.47.0-2.fc39.x86_64
libcap-2.48-9.fc39.x86_64
libtalloc-2.4.1-1.fc39.x86_64
libuuid-2.39.3-5.fc39.x86_64
libblkid-2.39.3-5.fc39.x86_64
keyutils-libs-1.6.1-7.fc39.x86_64
pcre2-10.42-1.fc39.2.x86_64
libunistring-1.1-5.fc39.x86_64
libxcrypt-4.4.36-2.fc39.x86_64
libtevent-0.15.0-1.fc39.x86_64
bzip2-libs-1.0.8-16.fc39.x86_64
libstdc++-13.2.1-6.fc39.x86_64
libtdb-1.4.9-1.fc39.x86_64
libidn2-2.3.7-1.fc39.x86_64
grep-3.11-3.fc39.x86_64
jansson-2.13.1-7.fc39.x86_64
libseccomp-2.5.3-6.fc39.x86_64
elfutils-libelf-0.190-4.fc39.x86_64
gmp-6.2.1-5.fc39.x86_64
json-c-0.17-1.fc39.x86_64
libgpg-error-1.47-2.fc39.x86_64
libmnl-1.0.5-3.fc39.x86_64
lz4-libs-1.9.4-4.fc39.x86_64
systemd-libs-254.9-1.fc39.x86_64
dbus-libs-1.14.10-1.fc39.x86_64
libxml2-2.10.4-3.fc39.x86_64
readline-8.2-6.fc39.x86_64
alternatives-1.26-1.fc39.x86_64
libattr-2.5.1-8.fc39.x86_64
libacl-2.3.1-9.fc39.x86_64
libbasicobjects-0.1.1-54.fc39.x86_64
libcollection-0.7.0-54.fc39.x86_64
libref_array-0.1.5-54.fc39.x86_64
libsss_idmap-2.9.4-1.fc39.x86_64
grub2-common-2.06-116.fc39.noarch
libedit-3.1-48.20230828cvs.fc39.x86_64
libcap-ng-0.8.3-8.fc39.x86_64
audit-libs-3.1.2-8.fc39.x86_64
libdhash-0.5.0-54.fc39.x86_64
libnl3-3.9.0-1.fc39.x86_64
protobuf-c-1.4.1-5.fc39.x86_64
nettle-3.9.1-2.fc39.x86_64
libbpf-1.1.0-4.fc39.x86_64
sqlite-libs-3.42.0-7.fc39.x86_64
fuse3-libs-3.16.1-1.fc39.x86_64
libeconf-0.5.2-1.fc39.x86_64
pam-libs-1.5.3-3.fc39.x86_64
libsepol-3.5-2.fc39.x86_64
libselinux-3.5-5.fc39.x86_64
sed-4.8-14.fc39.x86_64
libmount-2.39.3-5.fc39.x86_64
libsemanage-3.5-4.fc39.x86_64
shadow-utils-4.14.0-2.fc39.x86_64
libtasn1-4.19.0-3.fc39.x86_64
libfdisk-2.39.3-5.fc39.x86_64
expat-2.5.0-3.fc39.x86_64
libaio-0.3.111-16.fc39.x86_64
lmdb-libs-0.9.32-1.fc39.x86_64
lzo-2.10-9.fc39.x86_64
userspace-rcu-0.14.0-3.fc39.x86_64
findutils-4.9.0-5.fc39.x86_64
libselinux-utils-3.5-5.fc39.x86_64
tar-1.35-2.fc39.x86_64
fuse3-3.16.1-1.fc39.x86_64
procps-ng-4.0.3-5.fc39.x86_64
libnftnl-1.2.6-2.fc39.x86_64
libassuan-2.5.6-2.fc39.x86_64
libgcrypt-1.10.2-2.fc39.x86_64
xz-5.4.4-1.fc39.x86_64
fmt-10.0.0-3.fc39.x86_64
gdisk-1.0.9-6.fc39.x86_64
e2fsprogs-libs-1.47.0-2.fc39.x86_64
file-libs-5.44-5.fc39.x86_64
file-5.44-5.fc39.x86_64
pigz-2.8-2.fc39.x86_64
diffutils-3.10-3.fc39.x86_64
efivar-libs-39-1.fc39.x86_64
fuse-libs-2.9.9-17.fc39.x86_64
libcbor-0.10.2-2.fc39.x86_64
libdb-5.3.28-56.fc39.x86_64
libffi-3.4.4-4.fc39.x86_64
p11-kit-0.25.3-1.fc39.x86_64
p11-kit-trust-0.25.3-1.fc39.x86_64
gnutls-3.8.3-1.fc39.x86_64
glib2-2.78.3-1.fc39.x86_64
json-glib-1.8.0-1.fc39.x86_64
polkit-libs-123-1.fc39.1.x86_64
NetworkManager-libnm-1.44.2-1.fc39.x86_64
shared-mime-info-2.2-4.fc39.x86_64
libmaxminddb-1.9.1-1.fc39.x86_64
libnfnetlink-1.0.1-24.fc39.x86_64
libnetfilter_conntrack-1.0.9-2.fc39.x86_64
libnghttp2-1.55.1-4.fc39.x86_64
libsmartcols-2.39.3-5.fc39.x86_64
util-linux-core-2.39.3-5.fc39.x86_64
libxmlb-0.3.15-1.fc39.x86_64
conmon-2.1.8-2.fc39.x86_64
libgudev-238-2.fc39.x86_64
libslirp-4.7.0-4.fc39.x86_64
slirp4netns-1.2.2-1.fc39.x86_64
nano-7.2-4.fc39.x86_64
nano-default-editor-7.2-4.fc39.noarch
btrfs-progs-6.7-1.fc39.x86_64
spdlog-1.12.0-2.fc39.x86_64
wasmedge-rt-0.13.5-1.fc39.x86_64
squashfs-tools-4.6.1-2.fc39.x86_64
shadow-utils-subid-4.14.0-2.fc39.x86_64
bubblewrap-0.8.0-1.fc39.x86_64
libibverbs-46.0-4.fc39.x86_64
libpcap-1.10.4-2.fc39.x86_64
iptables-libs-1.8.9-5.fc39.x86_64
nftables-1.0.7-3.fc39.x86_64
iptables-legacy-libs-1.8.9-5.fc39.x86_64
iptables-legacy-1.8.9-5.fc39.x86_64
iptables-utils-1.8.9-5.fc39.x86_64
libnl3-cli-3.9.0-1.fc39.x86_64
libteam-1.32-1.fc39.x86_64
grub2-pc-modules-2.06-116.fc39.noarch
gettext-libs-0.22-2.fc39.x86_64
libusb1-1.0.26-3.fc39.x86_64
libgusb-0.4.8-1.fc39.x86_64
ethtool-6.7-1.fc39.x86_64
libksba-1.6.4-2.fc39.x86_64
mpfr-4.2.0-3.fc39.x86_64
libpsl-0.21.2-4.fc39.x86_64
libicu-73.2-2.fc39.x86_64
snappy-1.1.10-2.fc39.x86_64
libipa_hbac-2.9.4-1.fc39.x86_64
keyutils-1.6.1-7.fc39.x86_64
libss-1.47.0-2.fc39.x86_64
dbus-common-1.14.10-1.fc39.noarch
dbus-broker-35-2.fc39.x86_64
dbus-1.14.10-1.fc39.x86_64
hostname-3.23-9.fc39.x86_64
jemalloc-5.3.0-4.fc39.x86_64
less-633-2.fc39.x86_64
psmisc-23.6-4.fc39.x86_64
iproute-6.4.0-2.fc39.x86_64
aardvark-dns-1.10.0-1.fc39.x86_64
netavark-1.10.1-5.fc39.x86_64
c-ares-1.25.0-1.fc39.x86_64
cpio-2.14-4.fc39.x86_64
device-mapper-persistent-data-1.0.9-1.fc39.x86_64
dosfstools-4.2-7.fc39.x86_64
duktape-2.7.0-5.fc39.x86_64
fstrm-0.6.1-8.fc39.x86_64
gdbm-libs-1.23-4.fc39.x86_64
cyrus-sasl-lib-2.1.28-11.fc39.x86_64
gettext-envsubst-0.22-2.fc39.x86_64
gettext-runtime-0.22-2.fc39.x86_64
gvisor-tap-vsock-gvforwarder-0.7.2-1.fc39.x86_64
inih-58-1.fc39.x86_64
libargon2-20190702-3.fc39.x86_64
libdaemon-0.14-26.fc39.x86_64
teamd-1.32-1.fc39.x86_64
libmd-1.1.0-2.fc39.x86_64
libbsd-0.11.7-5.fc39.x86_64
libndp-1.8-6.fc39.x86_64
libnet-1.3-1.fc39.x86_64
criu-3.19-2.fc39.x86_64
criu-libs-3.19-2.fc39.x86_64
libpath_utils-0.2.1-54.fc39.x86_64
libini_config-1.3.1-54.fc39.x86_64
libpkgconf-1.9.5-2.fc39.x86_64
pkgconf-1.9.5-2.fc39.x86_64
pkgconf-pkg-config-1.9.5-2.fc39.x86_64
libsigsegv-2.14-5.fc39.x86_64
gawk-5.2.2-2.fc39.x86_64
libsss_nss_idmap-2.9.4-1.fc39.x86_64
libsss_sudo-2.9.4-1.fc39.x86_64
libtool-ltdl-2.4.7-7.fc39.x86_64
libuv-1.47.0-3.fc39.x86_64
libverto-0.3.2-6.fc39.x86_64
libyaml-0.2.5-12.fc39.x86_64
linux-atm-libs-2.5.1-36.fc39.x86_64
lua-libs-5.4.6-3.fc39.x86_64
npth-1.6-14.fc39.x86_64
numactl-libs-2.0.16-3.fc39.x86_64
oniguruma-6.9.9-1.fc39.x86_64
jq-1.6-17.fc39.x86_64
sg3_utils-libs-1.46-6.fc39.x86_64
slang-2.3.3-4.fc39.x86_64
newt-0.52.23-4.fc39.x86_64
xxhash-libs-0.8.2-1.fc39.x86_64
yajl-2.1.0-22.fc39.x86_64
crun-1.14-1.fc39.x86_64
libreport-filesystem-2.17.11-3.fc39.noarch
kbd-misc-2.6.3-1.fc39.noarch
kbd-legacy-2.6.3-1.fc39.noarch
kbd-2.6.3-1.fc39.x86_64
coreutils-common-9.3-5.fc39.x86_64
openssl-libs-3.1.1-4.fc39.x86_64
coreutils-9.3-5.fc39.x86_64
ca-certificates-2023.2.60_v7.0.306-2.fc39.noarch
krb5-libs-1.21.2-3.fc39.x86_64
libcurl-minimal-8.2.1-4.fc39.x86_64
libtirpc-1.3.4-0.rc2.fc39.x86_64
libarchive-3.7.1-1.fc39.x86_64
kmod-30-6.fc39.x86_64
tpm2-tss-4.0.1-6.fc39.x86_64
kmod-libs-30-6.fc39.x86_64
libsss_certmap-2.9.4-1.fc39.x86_64
libevent-2.1.12-9.fc39.x86_64
openldap-2.6.6-1.fc39.x86_64
libldb-2.8.0-1.fc39.x86_64
gnupg2-2.4.3-4.fc39.x86_64
gpgme-1.20.0-5.fc39.x86_64
ostree-libs-2023.8-3.fc39.x86_64
libnfsidmap-2.6.4-0.rc3.fc39.x86_64
curl-8.2.1-4.fc39.x86_64
cyrus-sasl-gssapi-2.1.28-11.fc39.x86_64
gzip-1.12-6.fc39.x86_64
which-2.21-40.fc39.x86_64
libfido2-1.13.0-3.fc39.x86_64
libjose-11-8.fc39.x86_64
zchunk-libs-1.4.0-1.fc39.x86_64
jose-11-8.fc39.x86_64
fuse-2.9.9-17.fc39.x86_64
cracklib-2.9.11-2.fc39.x86_64
libpwquality-1.4.5-6.fc39.x86_64
adcli-0.9.2-3.fc39.x86_64
sssd-nfs-idmap-2.9.4-1.fc39.x86_64
libjcat-0.2.1-1.fc39.x86_64
libuser-0.64-4.fc39.x86_64
avahi-libs-0.8-24.fc39.x86_64
tpm2-tss-fapi-4.0.1-6.fc39.x86_64
tpm2-tools-5.5-4.fc39.x86_64
fuse-overlayfs-1.12-2.fc39.x86_64
libnsl2-2.0.0-6.fc39.x86_64
pam-1.5.3-3.fc39.x86_64
authselect-1.4.3-1.fc39.x86_64
authselect-libs-1.4.3-1.fc39.x86_64
cryptsetup-libs-2.6.1-3.fc39.x86_64
device-mapper-libs-1.02.197-1.fc39.x86_64
device-mapper-1.02.197-1.fc39.x86_64
elfutils-libs-0.190-4.fc39.x86_64
elfutils-default-yama-scope-0.190-4.fc39.noarch
libutempter-1.2.1-10.fc39.x86_64
systemd-pam-254.9-1.fc39.x86_64
util-linux-2.39.3-5.fc39.x86_64
systemd-254.9-1.fc39.x86_64
systemd-resolved-254.9-1.fc39.x86_64
systemd-udev-254.9-1.fc39.x86_64
NetworkManager-1.44.2-1.fc39.x86_64
console-login-helper-messages-0.21.3-6.fc39.noarch
openssh-9.3p1-10.fc39.x86_64
device-mapper-event-libs-1.02.197-1.fc39.x86_64
grub2-tools-minimal-2.06-116.fc39.x86_64
kpartx-0.9.5-2.fc39.x86_64
openssh-clients-9.3p1-10.fc39.x86_64
polkit-123-1.fc39.1.x86_64
polkit-pkla-compat-0.1-26.fc39.x86_64
coreos-installer-0.20.0-1.fc39.x86_64
os-prober-1.81-4.fc39.x86_64
device-mapper-event-1.02.197-1.fc39.x86_64
lvm2-libs-2.03.23-1.fc39.x86_64
lvm2-2.03.23-1.fc39.x86_64
openssh-server-9.3p1-10.fc39.x86_64
afterburn-5.5.1-1.fc39.x86_64
clevis-19-4.fc39.x86_64
containernetworking-plugins-1.3.0-3.fc39.x86_64
dnsmasq-2.89-7.fc39.x86_64
flatpak-session-helper-1.15.6-1.fc39.x86_64
iputils-20221126-4.fc39.x86_64
libkcapi-1.4.0-7.fc39.x86_64
libkcapi-hmaccalc-1.4.0-7.fc39.x86_64
dracut-059-16.fc39.x86_64
dracut-network-059-16.fc39.x86_64
kernel-modules-core-6.7.4-200.fc39.x86_64
kernel-core-6.7.4-200.fc39.x86_64
grub2-tools-2.06-116.fc39.x86_64
grub2-efi-x64-2.06-116.fc39.x86_64
kernel-modules-6.7.4-200.fc39.x86_64
dracut-squash-059-16.fc39.x86_64
ostree-2023.8-3.fc39.x86_64
logrotate-3.21.0-4.fc39.x86_64
samba-common-4.19.4-3.fc39.noarch
libwbclient-4.19.4-3.fc39.x86_64
samba-common-libs-4.19.4-3.fc39.x86_64
samba-client-libs-4.19.4-3.fc39.x86_64
libsmbclient-4.19.4-3.fc39.x86_64
rpcbind-1.2.6-4.rc2.fc39.1.x86_64
device-mapper-multipath-libs-0.9.5-2.fc39.x86_64
cryptsetup-2.6.1-3.fc39.x86_64
libluksmeta-9-16.fc39.x86_64
luksmeta-9-16.fc39.x86_64
clevis-luks-19-4.fc39.x86_64
clevis-systemd-19-4.fc39.x86_64
sssd-client-2.9.4-1.fc39.x86_64
sssd-common-2.9.4-1.fc39.x86_64
sssd-krb5-common-2.9.4-1.fc39.x86_64
sssd-common-pac-2.9.4-1.fc39.x86_64
isns-utils-libs-0.101-7.fc39.x86_64
iscsi-initiator-utils-iscsiuio-6.2.1.9-17.gitc26218d.fc39.x86_64
iscsi-initiator-utils-6.2.1.9-17.gitc26218d.fc39.x86_64
libnvme-1.6-2.fc39.x86_64
nvme-cli-2.6-1.fc39.x86_64
mokutil-0.6.0-7.fc39.x86_64
rpm-sequoia-1.6.0-1.fc39.x86_64
rpm-libs-4.19.1-2.fc39.x86_64
libmodulemd-2.15.0-5.fc39.x86_64
librepo-1.17.0-1.fc39.x86_64
libsolv-0.7.27-1.fc39.x86_64
rpm-4.19.1-2.fc39.x86_64
policycoreutils-3.5-8.fc39.x86_64
selinux-policy-39.4-1.fc39.noarch
selinux-policy-targeted-39.4-1.fc39.noarch
container-selinux-2.229.0-1.fc39.noarch
containers-common-1-99.fc39.noarch
skopeo-1.14.0-1.fc39.x86_64
runc-1.1.12-1.fc39.x86_64
containerd-1.6.23-2.fc39.x86_64
passt-0^20231230.gf091893-1.fc39.x86_64
passt-selinux-0^20231230.gf091893-1.fc39.noarch
containers-common-extra-1-99.fc39.noarch
rpm-ostree-libs-2024.2-2.fc39.x86_64
catatonit-0.1.7-18.fc39.x86_64
podman-4.9.0-1.fc39.x86_64
bind-license-9.18.21-2.fc39.noarch
bind-libs-9.18.21-2.fc39.x86_64
bind-utils-9.18.21-2.fc39.x86_64
sssd-ad-2.9.4-1.fc39.x86_64
sssd-ipa-2.9.4-1.fc39.x86_64
toolbox-0.0.99.5-2.fc39.x86_64
rpm-ostree-2024.2-2.fc39.x86_64
console-login-helper-messages-motdgen-0.21.3-6.fc39.noarch
rpm-plugin-selinux-4.19.1-2.fc39.x86_64
shim-x64-15.6-2.x86_64
google-compute-engine-guest-configs-udev-20230929.00-1.fc39.noarch
sssd-krb5-2.9.4-1.fc39.x86_64
sssd-ldap-2.9.4-1.fc39.x86_64
clevis-dracut-19-4.fc39.x86_64
device-mapper-multipath-0.9.5-2.fc39.x86_64
nfs-utils-coreos-2.6.4-0.rc3.fc39.x86_64
cifs-utils-7.0-2.fc39.x86_64
kexec-tools-2.0.27-4.fc39.x86_64
kernel-6.7.4-200.fc39.x86_64
grub2-pc-2.06-116.fc39.x86_64
afterburn-dracut-5.5.1-1.fc39.x86_64
ignition-2.17.0-1.fc39.x86_64
podman-plugins-4.9.0-1.fc39.x86_64
ssh-key-dir-0.1.4-4.fc39.x86_64
cloud-utils-growpart-0.33-3.fc39.noarch
coreos-installer-bootinfra-0.20.0-1.fc39.x86_64
fuse-sshfs-3.7.3-4.fc39.x86_64
git-core-2.43.0-1.fc39.x86_64
console-login-helper-messages-issuegen-0.21.3-6.fc39.noarch
console-login-helper-messages-profile-0.21.3-6.fc39.noarch
NetworkManager-cloud-setup-1.44.2-1.fc39.x86_64
NetworkManager-team-1.44.2-1.fc39.x86_64
NetworkManager-tui-1.44.2-1.fc39.x86_64
audit-3.1.2-8.fc39.x86_64
bootupd-0.2.17-2.fc39.x86_64
chrony-4.5-1.fc39.x86_64
fwupd-1.9.11-1.fc39.x86_64
iptables-services-1.8.9-5.fc39.noarch
mdadm-4.2-6.fc39.x86_64
net-tools-2.0-0.67.20160912git.fc39.x86_64
stalld-1.16-7.fc39.x86_64
systemd-container-254.9-1.fc39.x86_64
wireguard-tools-1.0.20210914-5.fc39.x86_64
zram-generator-1.1.2-8.fc39.x86_64
passwd-0.80-15.fc39.x86_64
sudo-1.9.15-1.p5.fc39.x86_64
bsdtar-3.7.1-1.fc39.x86_64
lsof-4.96.3-4.fc39.x86_64
iptables-nft-1.8.9-5.fc39.x86_64
openssl-3.1.1-4.fc39.x86_64
rsync-3.2.7-5.fc39.x86_64
socat-1.7.4.4-3.fc39.x86_64
crun-wasm-1.14-1.fc39.x86_64
sg3_utils-1.46-6.fc39.x86_64
irqbalance-1.9.2-2.fc39.x86_64
iproute-tc-6.4.0-2.fc39.x86_64
bash-completion-2.11-12.fc39.noarch
xfsprogs-6.4.0-1.fc39.x86_64
e2fsprogs-1.47.0-2.fc39.x86_64
ipcalc-1.0.3-2.fc39.x86_64
efibootmgr-18-4.fc39.x86_64
vim-minimal-9.1.031-1.fc39.x86_64
acl-2.3.1-9.fc39.x86_64
attr-2.5.1-8.fc39.x86_64
zstd-1.5.5-4.fc39.x86_64
bzip2-1.0.8-16.fc39.x86_64
WALinuxAgent-udev-2.9.1.1-1.fc39.noarch
ncurses-6.4-7.20230520.fc39.x86_64
nmstate-2.2.21-2.fc39.x86_64
nss-altfiles-2.23.0-1.fc39.x86_64
fedora-repos-archive-39-1.noarch
microcode_ctl-2.1-58.fc39.x86_64
fedora-repos-ostree-39-1.noarch
bash-color-prompt-0.4-1.fc39.noarch
libatomic-13.2.1-6.fc39.x86_64
libxslt-1.1.39-1.fc39.x86_64
xmlsec1-1.2.37-5.fc39.x86_64
hwdata-0.379-1.fc39.noarch
libpciaccess-0.16-9.fc39.x86_64
libdrm-2.4.120-1.fc39.x86_64
xmlsec1-openssl-1.2.37-5.fc39.x86_64
pciutils-libs-3.10.0-3.fc39.x86_64
pciutils-3.10.0-3.fc39.x86_64
liburing-2.5-1.fc39.x86_64
libretls-3.8.1-1.fc39.x86_64
libgomp-13.2.1-6.fc39.x86_64
libb2-0.98.1-9.fc39.x86_64
libfdt-1.7.0-5.fc39.x86_64
dpdk-22.11.1-2.fc39.x86_64
kernel-headers-6.7.3-200.fc39.x86_64
libxdp-1.4.1-1.fc39.x86_64
python-pip-wheel-23.2.1-1.fc39.noarch
mpdecimal-2.5.1-7.fc39.x86_64
python-unversioned-command-3.12.2-2.fc39.noarch
python3-3.12.2-2.fc39.x86_64
python3-libs-3.12.2-2.fc39.x86_64
unbound-anchor-1.19.1-2.fc39.x86_64
unbound-libs-1.19.1-2.fc39.x86_64
openvswitch-3.2.0-1.fc39.x86_64
openvswitch-dpdk-3.2.0-1.fc39.x86_64
libmspack-0.10.1-0.10.alpha.fc39.x86_64
open-vm-tools-12.3.5-1.fc39.x86_64
NetworkManager-ovs-1.44.2-1.fc39.x86_64
netcat-1.226-1.fc39.x86_64
qemu-guest-agent-8.1.3-4.fc39.x86_64
openshift-hyperkube-1.28.7-1.0.6e2789b.x86_64
openshift-clients-0.0.1-1.el8.x86_64
ecr-credential-provider-4.15.0-999999999999.el9.x86_64
cri-tools-1.26.0-.fc38.1.1.1.x86_64
cri-o-1.28.2-2.1.fc39.x86_64

[tgerla]

Hi @lokcio, thanks for the additional details. The reason Grype doesn't show any vulnerabilities is because we don't currently have a feed of vulnerability data for Fedora yet. We would need to implement a Vunnel provider (https://github.com/anchore/vunnel) for the Fedora database at https://bodhi.fedoraproject.org/.

(If it's helpful, we did notice that in your SBOM it looks like you are scanning your Fedora system as well as the overlay filesystems for some containers running on that same system -- you may want to consider using the --exclude option on the /sysroot/ostree/deploy/fedora-coreos/var/lib/containers/ path to limit the scan to the host system itself.)

We will open up an enhancement request in the Vunnel repository to implement a provider for Fedora. If that's something you're interested in working on, let us know and we can help get you started!