Noisy/confusing Ignore the OS package as no OS is detected warnings on initial scans of Wolfi images

[chadlwilson]

Description

When scanning Wolfi images on an initial run, currently you are spammed with a whole lot of messages like

2024-07-01T15:21:43-07:00	WARN	Ignore the OS package as no OS is detected.

There is no context logged for which package is the problem, and more confusingly, it does detect Wolfi, in a later log after all the warnings:

2024-07-01T15:21:45-07:00	INFO	Detected OS	family="wolfi" version="20230201"

It's hard to know how to take action on these. Are these warnings being unnecessarily emitted by code run in the wrong order, before it has detected the OS, perhaps?

Desired Behavior

I'd expect either

• remove the warnings if there is nothing I can do about them or if this is a real bug in order of OS detection
• OR include context for the warning (which package is the problem?)
• include information that can help me know what to do with this (ignore? change something about my image?)

Actual Behavior

A whole lot of errors like the below, with no actionable context.

2024-07-01T15:21:43-07:00	WARN	Ignore the OS package as no OS is detected.

Subsequent runs on an existing cache do not emit the warnings.

Reproduction Steps

1. `trivy clean --all`
2. `trivy image cgr.dev/chainguard/wolfi-base`

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

$ trivy image cgr.dev/chainguard/wolfi-base --debug
2024-07-02T12:51:37+08:00	DEBUG	Cache dir	dir="/Users/chad/Library/Caches/trivy"
2024-07-02T12:51:37+08:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-07-02T12:51:37+08:00	DEBUG	Ignore statuses	statuses=[]
2024-07-02T12:51:37+08:00	DEBUG	There is no valid metadata file	err="unable to open a file: open /Users/chad/Library/Caches/trivy/db/metadata.json: no such file or directory"
2024-07-02T12:51:37+08:00	INFO	Need to update DB
2024-07-02T12:51:37+08:00	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
2024-07-02T12:51:37+08:00	DEBUG	No metadata file
49.40 MiB / 49.40 MiB [---------------------------------------------------------------------] 100.00% 29.93 MiB p/s 1.9s
2024-07-02T12:51:40+08:00	DEBUG	Updating database metadata...
2024-07-02T12:51:40+08:00	DEBUG	DB info	schema=2 updated_at=2024-07-02T00:17:45.503172433Z next_update=2024-07-02T06:17:45.503172022Z downloaded_at=2024-07-02T04:51:40.864128Z
2024-07-02T12:51:40+08:00	INFO	Vulnerability scanning is enabled
2024-07-02T12:51:40+08:00	DEBUG	Vulnerability type	type=[os library]
2024-07-02T12:51:40+08:00	INFO	Secret scanning is enabled
2024-07-02T12:51:40+08:00	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-07-02T12:51:40+08:00	INFO	Please see also https://aquasecurity.github.io/trivy/v0.53/docs/scanner/secret#recommendation for faster secret detection
2024-07-02T12:51:40+08:00	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-07-02T12:51:40+08:00	DEBUG	Initializing scan cache...	type="fs"
2024-07-02T12:51:40+08:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2024-07-02T12:51:40+08:00	DEBUG	[nuget] The nuget packages directory couldn't be found. License search disabled
2024-07-02T12:51:40+08:00	DEBUG	[secret] No secret config detected	config_path="trivy-secret.yaml"
2024-07-02T12:51:40+08:00	DEBUG	[image] Detected image ID	image_id="sha256:98ca4b4d7e6d6d630431477d81e77d9eaf209bd4d521194f02f979815fe0a886"
2024-07-02T12:51:40+08:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:681a6a83dfe69a41e050160355996198a6170d2766647fedf0be6a42578ab55e]
2024-07-02T12:51:40+08:00	DEBUG	[image] Detected base layers	diff_ids=[]
2024-07-02T12:51:40+08:00	DEBUG	[image] Missing image ID in cache	image_id="sha256:98ca4b4d7e6d6d630431477d81e77d9eaf209bd4d521194f02f979815fe0a886"
2024-07-02T12:51:40+08:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:681a6a83dfe69a41e050160355996198a6170d2766647fedf0be6a42578ab55e"
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	WARN	Ignore the OS package as no OS is detected.
2024-07-02T12:51:41+08:00	DEBUG	No secrets found in container image config
2024-07-02T12:51:41+08:00	INFO	Detected OS	family="wolfi" version="20230201"
2024-07-02T12:51:41+08:00	INFO	[wolfi] Detecting vulnerabilities...	pkg_num=14
2024-07-02T12:51:41+08:00	INFO	Number of language-specific files	num=0

cgr.dev/chainguard/wolfi-base (wolfi 20230201)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Operating System

macOS Sonoma 14.5

Version

$ trivy --version
Version: 0.53.0

### Checklist

- [X] Run `trivy clean --all`
- [X] Read [the troubleshooting](https://aquasecurity.github.io/trivy/latest/docs/references/troubleshooting/)

[knqyf263]

It's weird that the message is shown with detected OS. @DmitriyLewen Can you please take a look?

[DmitriyLewen]

hmm... I didn't think about that because Trivy uses version (IIUC date of build/update) anyway.
This means that there may be cases when distro doesn't exist.

ok, then I'll continue working on this.

[chadlwilson]

Not sure if it matters for your purpose but for the standard Linux type of versions they just use the Wolfi epoch of 20230201 as the major version number (as detected by Trivy outside sboms right now normally). They tag their images with this along with latest and tools that detect Linux versions pick this up as the major version number and name.

So if things need a version number I think they expect you to pick up 20230201.

[DmitriyLewen]

We don't need a version, because we use one database for packages from any wolfi images.

[chadlwilson]

OK, sorry, probably just confused by the discussion above about versions, and trying to help (maybe beyond my skillset!).

Anyway, let me know if I can help with interacting with the Wolfi team. Otherwise I leave to you talented folks!

it's fantastic that Trivy is Wolfi-aware for apk scanning, and will be even more fantastic if the SBOM support can also get to the next level!

[DmitriyLewen]

FYI - created #7101 to detect OS from purl

[DmitriyLewen]

Created #7100