feat: add Bottlerocket OS package analyzer by 0intro · Pull Request #8653 · aquasecurity/trivy

0intro · 2025-03-31T16:58:35Z

Description

This change adds the Bottlerocket OS package analyzer.

This analyzer parses the package information provided in the application-inventory.json file, as specified on:

https://bottlerocket.dev/en/os/1.37.x/concepts/variants/#software-inventory

This change also defines the Bottlerocket OS family.

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

DmitriyLewen · 2025-04-01T05:01:13Z

Hi @0intro
Thank you for your work.

Trivy repository has been growing bigger and bigger lately.
So it's getting harder to maintain.
So we're trying to add only the functionality that the community needs.

Can you create a new Discussion with a proposal to add Bottlerocket?
If this future is in demand by the community - we'll review/merge etc. this PR.

0intro · 2025-04-01T16:56:13Z

Thanks. I've opened #8661.

knqyf263

Thanks for your great contribution! Since I have already heard about some needs on Bottlerocket, I think we want to move forward with this PR.

knqyf263 · 2025-04-07T08:14:55Z

pkg/fanal/analyzer/pkg/bottlerocket/testdata/application-inventory.json

Can we shrink the test data? Our policy for unit tests is not to include data that doesn't change the code path, so I think it's fine to keep it simple with just 2–3 cases, including the normal case and edge cases (if any).

Thanks, I've shrunk the test data down.

Copilot

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

pkg/fanal/analyzer/pkg/bottlerocket/bottlerocket.go:72

Consider wrapping the JSON unmarshal error with additional context to improve debugging clarity, such as including the source file or input length.

err = json.Unmarshal(b, &applicationInventory)

knqyf263 · 2025-04-09T08:48:42Z

Can you please take a look at the test failure?

0intro · 2025-04-09T09:07:46Z

I've just fixed the linter issue.

knqyf263 · 2025-04-09T11:21:04Z

You can run mage lint:fix and mage test:unit locally.

0intro · 2025-04-09T13:17:48Z

Surprisingly, the first pass of mage lint:fix lead to a build error. It should be fixed now.

knqyf263

It looks great! I left small comments.

knqyf263 · 2025-04-11T09:47:27Z

pkg/fanal/analyzer/pkg/bottlerocket/bottlerocket.go

+	b, err := io.ReadAll(r)
+	if err != nil {
+		return nil, err
+	}
+
+	var applicationInventory ApplicationInventory
+	err = json.Unmarshal(b, &applicationInventory)
+	if err != nil {
+		return nil, err
+	}


Is there any reason all the file content needs to be loaded?

Suggested change

b, err := io.ReadAll(r)

if err != nil {

return nil, err

}

var applicationInventory ApplicationInventory

err = json.Unmarshal(b, &applicationInventory)

if err != nil {

return nil, err

}

var applicationInventory ApplicationInventory

if err := json.NewDecoder(r).Decode(&applicationInventory); err != nil {

return nil, err

}

knqyf263 · 2025-04-11T09:54:55Z

pkg/fanal/analyzer/pkg/bottlerocket/bottlerocket.go

+}
+
+func (a bottlerocketPkgAnalyzer) Type() analyzer.Type {
+	return analyzer.TypeBottlerocket


nit: Other package analyzers use the name of the package manager, like rpm and apk. Since Bottlerocket is also an OS name, I would rename it to bottlerocket-package, bottlerocket-pkg or things like that so it will not get confused with Bottlerocket OS analyzer.

This is a good point, but I haven't been able to find a good name. What do you think about bottlerocket-inventory? The file is usually called either application inventory or software inventory in the Bottlerocket documentation.

bottlerocket-inventory sounds good to me.

0intro · 2025-04-14T12:23:35Z

I've renamed the bottlerocket package to bottlerocket_inventory.

knqyf263

LGTM.
@DmitriyLewen Can you also take a look?

DmitriyLewen

I see a few things:

I think Trivy shows warning (something like WARN Unsupported os family="bottlerocket"). This might confuse users. Let's create a new ospkg driver. This driver will only show the Info log that Trivy does not support vulnerability detection for bottlerocket packages (the Detect function will simply return nil).
@knqyf263 wdyt?
I think we need to update the purl package.
We can add the bottlerocket purl type to Trivy (until package-url/purl-spec#454 is merged). You also need to update other functions (purlType, LangType, etc.)
or we can use generic type
Add Bottlerocket page in docs

DmitriyLewen · 2025-04-15T06:02:16Z

pkg/fanal/analyzer/pkg/bottlerocket_inventory/bottlerocket-inventory.go

let's use same name as in package (bottlerocket_inventory.go) (with _)

If I'm not mistaken, it's still mixed.

pkg/fanal/analyzer/pkg/bottlerocket_inventory/bottlerocket-inventory_test.go should be pkg/fanal/analyzer/pkg/bottlerocket-inventory/bottlerocket-inventory_test.go

Sorry, it should be fine now.

knqyf263 · 2025-04-15T07:02:50Z

I think Trivy shows warning (something like WARN Unsupported os family="bottlerocket"). This might confuse users. Let's create a new ospkg driver. This driver will only show the Info log that Trivy does not support vulnerability detection for bottlerocket packages (the Detect function will simply return nil).

I thought we could document Trivy supports Bottlerocket only for SBOM, but UX would be better if we show the log message like you suggested.

DmitriyLewen · 2025-04-15T07:08:48Z

Thanks for pointing this out, I forgot to write about it in the review:
We need to add information to the bottlerocket OS documentation.

DmitriyLewen · 2025-04-16T05:44:46Z

@0intro do you have time to update this PR as per notes from #8653 (review)?

0intro · 2025-04-16T14:45:25Z

@0intro do you have time to update this PR as per notes from #8653 (review)?

Yes, I'll take a look.

0intro · 2025-04-16T15:10:42Z

I've added a stub bottlerocket ospkg driver, which should get rid of the Unsupported os family="bottlerocket" warning.

knqyf263 · 2025-04-23T18:01:12Z

I picked up some images from https://gallery.ecr.aws/bottlerocket/, but their OS was Amazon Linux. How can I test this PR with actual images?

0intro · 2025-04-28T16:02:12Z

To deploy Bottlerocket on AWS, I've created an EC2 instance using resolve:ssm:/aws/service/bottlerocket/aws-ecs-2/x86_64/latest/image_id as an ImageId.

knqyf263

I had trouble enabling SSM properly when launching a Bottlerocket AMI on EC2, so I wasn’t able to access the shell. I was finally able to view Bottlerocket’s root filesystem by launching it as an instance within an EKS cluster. If there’s an easier way to do this, I’d really appreciate it if you could let me know—it would make future testing much smoother.

Sorry for the delay in commenting; it took some time to get the setup working correctly.

knqyf263 · 2025-05-01T12:08:15Z

pkg/fanal/analyzer/os/release/release.go

+	"aarch64-bottlerocket-linux-gnu/sys-root/usr/lib/os-release",
+	"x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/os-release",


Have you ever seen a case where /usr/lib/os-release doesn't exist and only ${arch}-bottlerocket-linux-gnu/sys-root/usr/lib/os-release exists? In my environment, /usr/lib/os-release is present. If /usr/lib/os-release is always present, we don't need to check ${arch}-bottlerocket-linux-gnu/sys-root/usr/lib/os-release.

[root@admin]# ls -alh /.bottlerocket/rootfs/usr/lib/os-release -rw-r--r--. 1 root root 455 Apr 23 00:29 /.bottlerocket/rootfs/usr/lib/os-release [root@admin]# cat /.bottlerocket/rootfs/usr/lib/os-release NAME=Bottlerocket ID=bottlerocket VERSION="1.37.0 (aws-k8s-1.30)" PRETTY_NAME="Bottlerocket OS 1.37.0 (aws-k8s-1.30)" VARIANT_ID=aws-k8s-1.30 VERSION_ID=1.37.0 BUILD_ID=e5290cd7 VENDOR_NAME="Bottlerocket" HOME_URL="https://github.com/bottlerocket-os/bottlerocket" SUPPORT_URL="https://github.com/bottlerocket-os/bottlerocket/discussions" BUG_REPORT_URL="https://github.com/bottlerocket-os/bottlerocket/issues" DOCUMENTATION_URL="https://bottlerocket.dev"

Yes, ${arch}-bottlerocket-linux-gnu/sys-root/usr/lib/os-release is mounted to /usr/lib/os-release at run time. When Bottlerocket is running, you can access to /usr/lib/os-release, but when mounting the Bottlerocket partition, you only have access to ${arch}-bottlerocket-linux-gnu/sys-root/usr/lib/os-release. I'm using Trivy in this later case.

knqyf263 · 2025-05-01T12:12:18Z

pkg/fanal/analyzer/pkg/bottlerocket_inventory/bottlerocket_inventory.go

+		pkg := types.Package{
+			Arch:    app.Architecture,
+			Name:    app.Name,
+			Version: app.Version,
+		}


We also need epoch. Otherwise, it leads to false detection.

{ "Name": "xfscli", "Publisher": "bottlerocket-core-kit", "Version": "0.0", "Release": "1.1745352352.c92146c5.br1", "Epoch": "1", "InstalledTime": "2025-04-23T00:26:38Z", "ApplicationType": "Unspecified", "Architecture": "x86_64", "Url": "https://github.com/bottlerocket-os/bottlerocket", "Summary": "XFS progs cli" },

I've just added handling of epoch.

knqyf263

@DmitriyLewen Can you also take a look?

DmitriyLewen

LGTM
left small comments about comments, tests and purl package

@0intro and can you fix linter errors (mage lint:fix and mage lint:run commands help you)?

pkg/fanal/analyzer/pkg/bottlerocket_inventory/bottlerocket_inventory.go

DmitriyLewen · 2025-05-15T09:20:16Z

pkg/detector/ospkg/bottlerocket/bottlerocket.go

+	return &Scanner{}
+}
+
+// Detect vulnerabilities in package using Bottlerocket scanner


This is incorrect, because we don't detect vulns for Bottlerocket pkgs.

DmitriyLewen · 2025-05-15T09:20:43Z

pkg/detector/ospkg/bottlerocket/bottlerocket.go

+}
+
+// Detect vulnerabilities in package using Bottlerocket scanner
+func (s *Scanner) Detect(ctx context.Context, osVer string, repo *ftypes.Repository, pkgs []ftypes.Package) ([]types.DetectedVulnerability, error) {


Let's add Info log that Trivy currently doesn't support vulnerability detection for Bottlerocket packages.

DmitriyLewen · 2025-05-15T09:26:58Z

pkg/purl/purl.go

+	// Temporary type before being added in github.com/package-url/packageurl-go
+	packageurlTypeBottlerocket = "bottlerocket"


Suggested change

// Temporary type before being added in github.com/package-url/packageurl-go

packageurlTypeBottlerocket = "bottlerocket"

// Temporary type before being added in github.com/package-url/packageurl-go

// cf. https://github.com/package-url/purl-spec/issues/454

packageurlTypeBottlerocket = "bottlerocket"

DmitriyLewen · 2025-05-15T09:36:36Z

pkg/fanal/analyzer/os/release/release.go

Can you add small test case for bottlerrocker os-release file?

DmitriyLewen · 2025-05-15T09:41:46Z

pkg/purl/purl.go

I wrote 2 tests for your changes:

diff --git a/pkg/purl/purl_test.go b/pkg/purl/purl_test.go index 5607551da..ae00df05d 100644 --- a/pkg/purl/purl_test.go +++ b/pkg/purl/purl_test.go @@ -440,6 +440,38 @@ func TestNewPackageURL(t *testing.T) { }, }, }, + { + name: "bottlerocket package", + typ: ftypes.Bottlerocket, + metadata: types.Metadata{ + OS: &ftypes.OS{ + Family: ftypes.Bottlerocket, + Name: "v1.39.0", + }, + }, + pkg: ftypes.Package{ + ID: "glibc@2.40", + Name: "glibc", + Version: "2.40", + Epoch: 1, + Arch: "x86_64", + }, + want: &purl.PackageURL{ + Type: "bottlerocket", + Name: "glibc", + Version: "2.40", + Qualifiers: packageurl.Qualifiers{ + { + Key: "epoch", + Value: "1", + }, + { + Key: "distro", + Value: "bottlerocket-v1.39.0", + }, + }, + }, + }, } for _, tc := range testCases { @@ -710,6 +742,47 @@ func TestPackageURL_Package(t *testing.T) { }, }, }, + { + name: "bottlerocker with epoch", + pkgURL: &purl.PackageURL{ + Type: "bottlerocket", + Name: "glibc", + Version: "2.40", + Qualifiers: packageurl.Qualifiers{ + { + Key: "epoch", + Value: "1", + }, + { + Key: "distro", + Value: "bottlerocket-v1.39.0", + }, + }, + }, + wantPkg: &ftypes.Package{ + ID: "glibc@2.40", + Name: "glibc", + Version: "2.40", + Epoch: 1, + Identifier: ftypes.PkgIdentifier{ + PURL: &packageurl.PackageURL{ + Type: "bottlerocket", + Name: "glibc", + Version: "2.40", + Qualifiers: packageurl.Qualifiers{ + { + Key: "epoch", + Value: "1", + }, + { + Key: "distro", + Value: "bottlerocket-v1.39.0", + }, + }, + }, + }, + }, + }, { name: "wrong epoch", pkgURL: &purl.PackageURL{

Can you add these tests and update purl package (add epoch)?

DmitriyLewen · 2025-05-15T09:43:02Z

pkg/purl/purl.go

@@ -80,6 +83,10 @@ func New(t ftypes.TargetType, metadata types.Metadata, pkg ftypes.Package) (*Pac
 		if metadata.OS != nil {
 			namespace = string(metadata.OS.Family)
 		}
+	case packageurlTypeBottlerocket:


Add bottlerocker into purlType(t) function:

diff --git a/pkg/purl/purl.go b/pkg/purl/purl.go index c0287cca6..7c59ff4f4 100644 --- a/pkg/purl/purl.go +++ b/pkg/purl/purl.go @@ -7,7 +7,7 @@ import ( cn "github.com/google/go-containerregistry/pkg/name" version "github.com/knqyf263/go-rpm-version" - packageurl "github.com/package-url/packageurl-go" + "github.com/package-url/packageurl-go" "github.com/samber/lo" "golang.org/x/xerrors" @@ -489,6 +489,8 @@ func purlType(t ftypes.TargetType) string { ftypes.OpenSUSELeap, ftypes.OpenSUSETumbleweed, ftypes.SLES, ftypes.SLEMicro, ftypes.Photon, ftypes.Azure, ftypes.CBLMariner: return packageurl.TypeRPM + case ftypes.Bottlerocket: + return packageurlTypeBottlerocket case TypeOCI: return packageurl.TypeOCI case ftypes.Julia:

0intro · 2025-05-19T13:51:04Z

Thanks. I think I've done all the required changes.

DmitriyLewen

@0intro Thanks for your work!
LGTM.

I left 1 comment.
And you need to update docs (OS page):
https://trivy.dev/latest/docs/coverage/os/

PS use mage docs:serve to see your changes

PS2 fix linter errors please

pkg/purl/purl.go

0intro · 2025-05-21T07:34:42Z

I've added the documentation.

DmitriyLewen · 2025-05-21T09:20:37Z

@0intro Great!
run mage lint:fix please.

This change adds the Bottlerocket OS package analyzer. This analyzer parses the package information provided in the application-inventory.json file, as specified on: https://bottlerocket.dev/en/os/1.37.x/concepts/variants/#software-inventory This change also defines the Bottlerocket OS family.

DmitriyLewen

LGTM
@0intro Thanks for your contribution!

cc. @knqyf263

0intro requested review from DmitriyLewen and knqyf263 as code owners March 31, 2025 16:58

knqyf263 reviewed Apr 7, 2025

View reviewed changes

knqyf263 requested a review from Copilot April 7, 2025 08:15

Copilot AI reviewed Apr 7, 2025

View reviewed changes

0intro force-pushed the djc/analyzer-bottlerocket branch from f84d18a to 3dfed29 Compare April 7, 2025 09:45

0intro requested a review from knqyf263 April 9, 2025 07:29

0intro force-pushed the djc/analyzer-bottlerocket branch from 3dfed29 to 959aa16 Compare April 9, 2025 09:07

0intro force-pushed the djc/analyzer-bottlerocket branch from 959aa16 to e4808c8 Compare April 9, 2025 13:17

knqyf263 reviewed Apr 11, 2025

View reviewed changes

0intro force-pushed the djc/analyzer-bottlerocket branch from e4808c8 to eeb2241 Compare April 11, 2025 19:38

0intro requested a review from knqyf263 April 11, 2025 19:40

0intro force-pushed the djc/analyzer-bottlerocket branch from eeb2241 to 16218d2 Compare April 14, 2025 12:16

knqyf263 approved these changes Apr 14, 2025

View reviewed changes

DmitriyLewen reviewed Apr 15, 2025

View reviewed changes

0intro force-pushed the djc/analyzer-bottlerocket branch from 16218d2 to e6cfae8 Compare April 15, 2025 09:02

knqyf263 requested a review from DmitriyLewen April 16, 2025 05:41

0intro force-pushed the djc/analyzer-bottlerocket branch from e6cfae8 to 11e5765 Compare April 16, 2025 15:07

0intro force-pushed the djc/analyzer-bottlerocket branch from 83f5a11 to 5cc52ee Compare April 23, 2025 09:26

knqyf263 reviewed May 1, 2025

View reviewed changes

0intro force-pushed the djc/analyzer-bottlerocket branch from 5cc52ee to da46f44 Compare May 12, 2025 12:19

0intro requested a review from knqyf263 May 12, 2025 12:34

knqyf263 approved these changes May 15, 2025

View reviewed changes

DmitriyLewen reviewed May 15, 2025

View reviewed changes

0intro force-pushed the djc/analyzer-bottlerocket branch from da46f44 to 2197941 Compare May 19, 2025 13:49

0intro requested review from DmitriyLewen and knqyf263 May 19, 2025 13:50

0intro force-pushed the djc/analyzer-bottlerocket branch from 2197941 to ff5f568 Compare May 19, 2025 13:52

DmitriyLewen reviewed May 20, 2025

View reviewed changes

pkg/purl/purl.go Outdated Show resolved Hide resolved

0intro force-pushed the djc/analyzer-bottlerocket branch 3 times, most recently from dc913f1 to e4fd63a Compare May 21, 2025 07:34

0intro force-pushed the djc/analyzer-bottlerocket branch from e4fd63a to f9345fb Compare May 23, 2025 06:00

0intro requested a review from DmitriyLewen May 23, 2025 06:01

DmitriyLewen approved these changes May 23, 2025

View reviewed changes

knqyf263 added this pull request to the merge queue May 23, 2025

Merged via the queue into aquasecurity:main with commit 07ef63b May 23, 2025
17 checks passed

aqua-bot mentioned this pull request May 22, 2025

release: v0.63.0 [main] #8809

Merged

0intro referenced this pull request in DataDog/trivy May 26, 2025

feat: add Bottlerocket OS package analyzer (#8653)

ac597e6

aqua-bot mentioned this pull request Dec 16, 2025

release: v0.69.0 [release/v0.68] #9948

Closed

0intro mentioned this pull request Feb 18, 2026

feat(bottlerocket): add vulnerability matching for Bottlerocket OS #10207

Open

9 tasks

		"aarch64-bottlerocket-linux-gnu/sys-root/usr/lib/os-release",
		"x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/os-release",

		// Temporary type before being added in github.com/package-url/packageurl-go
		packageurlTypeBottlerocket = "bottlerocket"

Conversation

0intro commented Mar 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

DmitriyLewen commented Apr 1, 2025

Uh oh!

0intro commented Apr 1, 2025

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

knqyf263 commented Apr 9, 2025

Uh oh!

0intro commented Apr 9, 2025

Uh oh!

knqyf263 commented Apr 9, 2025

Uh oh!

0intro commented Apr 9, 2025

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

0intro commented Apr 14, 2025

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

knqyf263 commented Apr 15, 2025

Uh oh!

DmitriyLewen commented Apr 15, 2025

Uh oh!

DmitriyLewen commented Apr 16, 2025

Uh oh!

0intro commented Apr 16, 2025

Uh oh!

0intro commented Apr 16, 2025

Uh oh!

knqyf263 commented Apr 23, 2025

Uh oh!

0intro commented Apr 28, 2025

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

knqyf263 May 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

0intro commented Mar 31, 2025 •

edited

Loading

DmitriyLewen left a comment •

edited

Loading

knqyf263 May 1, 2025 •

edited

Loading

DmitriyLewen left a comment •

edited

Loading