SBOM

[laoshanxi]

#!/bin/bash

# List of binaries you want to track
BINARIES=()
for dir in nfpm_home/lib64 nfpm_home/bin; do
    if [ -d "$dir" ]; then
        while IFS= read -r -d '' file; do
            BINARIES+=("$(basename "$file")")
        done < <(find "$dir" -type f -print0)
    fi
done

# Extract package names for binaries (suppress errors)
readarray -t PACKAGES < <(
    for binary in "${BINARIES[@]}"; do
        dpkg -S "$binary" 2>/dev/null | awk -F: '{print $1}'
    done
)

# Deduplicate and convert to JSON array
PACKAGE_JSON=$(printf "%s\n" "${PACKAGES[@]}" | sort -u | jq -R . | jq -s .)

# Run syft and filter artifacts matching package names
syft scan dir:/var/lib --override-default-catalogers "deb-archive-cataloger,dpkg-db-cataloger" --select-catalogers "-file" -o json | jq --argjson packages "$PACKAGE_JSON" '
{
  artifacts: [.artifacts[] | select(.name as $name | $packages | index($name))]
}
' > syft.apt-packages.json