Latest Syft buildpack (2.0.0) relies on Syft CLI 1.x

[anthonydahanne]

What happened?

Since February 29th, the Anchore Syft team started publishing 1.x (from 0.x) versions of the Syft CLI.

It was about time the Syft Paketo buildpack upgraded to it! It's now done with the latest release of Paketo Syft Buildpack 2.0.0 (that relies on Syft CLI 1.11.1)

The changes

So, what are the changes we can observe, just looking at the files generated during a Java build?

Let's do a build of the sample maven app

pack build applications/maven
[...]
[detector] 10 of 26 buildpacks participating
[detector] paketo-buildpacks/ca-certificates   3.8.4
[detector] paketo-buildpacks/bellsoft-liberica 10.8.2
>> [detector] paketo-buildpacks/syft              1.47.1 <<
[detector] paketo-buildpacks/maven             6.17.3
[detector] paketo-buildpacks/executable-jar    6.11.0
[detector] paketo-buildpacks/apache-tomcat     8.1.3
[detector] paketo-buildpacks/apache-tomee      1.10.2
[detector] paketo-buildpacks/liberty           4.2.2
[detector] paketo-buildpacks/dist-zip          5.8.2
[detector] paketo-buildpacks/spring-boot       5.31.0
[...]

and let's pull its SBOMs

pack sbom download  applications/maven --output-dir maven-app
tree maven-app
maven-app/
└── layers
    └── sbom
        └── launch
            ├── buildpacksio_lifecycle
            │   └── launcher
            │       ├── sbom.cdx.json
            │       ├── sbom.spdx.json
            │       └── sbom.syft.json
            ├── paketo-buildpacks_bellsoft-liberica
            │   ├── helper
            │   │   └── sbom.syft.json
            │   └── jre
            │       └── sbom.syft.json
            ├── paketo-buildpacks_ca-certificates
            │   └── helper
            │       └── sbom.syft.json
            ├── paketo-buildpacks_executable-jar
            │   ├── sbom.cdx.json
            │   └── sbom.syft.json
            ├── paketo-buildpacks_spring-boot
            │   ├── helper
            │   │   └── sbom.syft.json
            │   └── spring-cloud-bindings
            │       └── sbom.syft.json
            └── sbom.legacy.json

15 directories, 11 files

Let's do the same using the new Syft buildpack (not yet in a composite, so we'll have to specify explicitly component buildpacks)

pack build applications/maven-new-syft \
  --builder paketobuildpacks/builder-jammy-buildpackless-tiny -b gcr.io/paketo-buildpacks/ca-certificates:3.8.4  -b gcr.io/paketo-buildpacks/bellsoft-liberica:10.8.2 -b gcr.io/paketo-buildpacks/syft:2.0.0 -b gcr.io/paketo-buildpacks/maven:6.17.3  -b gcr.io/paketo-buildpacks/executable-jar:6.11.0 -b gcr.io/paketo-buildpacks/spring-boot:5.31.0
pack sbom download  applications/maven-new-syft --output-dir maven-app-syft-new
tree maven-app-syft-new/
maven-app-syft-new/
└── layers
    └── sbom
        └── launch
            ├── buildpacksio_lifecycle
            │   └── launcher
            │       ├── sbom.cdx.json
            │       ├── sbom.spdx.json
            │       └── sbom.syft.json
            ├── paketo-buildpacks_bellsoft-liberica
            │   ├── helper
            │   │   └── sbom.syft.json
            │   └── jre
            │       └── sbom.syft.json
            ├── paketo-buildpacks_ca-certificates
            │   └── helper
            │       └── sbom.syft.json
            ├── paketo-buildpacks_executable-jar
            │   ├── sbom.cdx.json
            │   └── sbom.syft.json
            ├── paketo-buildpacks_spring-boot
            │   ├── helper
            │   │   └── sbom.syft.json
            │   └── spring-cloud-bindings
            │       └── sbom.syft.json
            └── sbom.legacy.json

15 directories, 11 files

OK, same set of files than before, that looks like a smooth start.

Let's compare them

Not many files were different, only the SBOMs generated by executable-jar; probably due by an upgrade of the schemas; from http://cyclonedx.org/schema/bom-1.5.schema.json to http://cyclonedx.org/schema/bom-1.6.schema.json for CycloneDX, and from https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-16.0.4.json to https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-16.0.15.json for Syft own format.

Conclusion?

Looking a little bit more deeper into the changes, Syft 1.x seems to find more dependencies, with more information about them (groupIds, maven locations, etc.).

That looks like a safe and even needed upgrade!

Please let us know in the comments if you have examples of breaking changes, before we make this buildpack the default with java and java-native composites!

Thanks for reading!