Description
When an image contains multiple CycloneDX SBOM files with the same BomRef for identical components, Trivy merges them without validating BomRef uniqueness. This results in duplicate component entries in the final SBOM output, causing
CycloneDX validation to fail.
Root Cause
Trivy processes and merges multiple CycloneDX files found in the container image but does not check whether a BomRef already exists before adding components to the final SBOM. When two CycloneDX files reference the same component with the
same BomRef, both entries are preserved, creating duplicates.
Expected Behavior
Trivy should validate BomRef uniqueness when merging multiple CycloneDX files and either:
- Skip duplicate components with the same BomRef
- Merge component information if they represent the same package
- Generate a warning about conflicting BomRefs
Actual Behavior
Duplicate components are included in the final SBOM, causing validation failures:
Found duplicates at the following index pairs: '(89, 90)'
Related
Description
When an image contains multiple CycloneDX SBOM files with the same BomRef for identical components, Trivy merges them without validating BomRef uniqueness. This results in duplicate component entries in the final SBOM output, causing
CycloneDX validation to fail.
Root Cause
Trivy processes and merges multiple CycloneDX files found in the container image but does not check whether a BomRef already exists before adding components to the final SBOM. When two CycloneDX files reference the same component with the
same BomRef, both entries are preserved, creating duplicates.
Expected Behavior
Trivy should validate BomRef uniqueness when merging multiple CycloneDX files and either:
Actual Behavior
Duplicate components are included in the final SBOM, causing validation failures:
Found duplicates at the following index pairs: '(89, 90)'
Related