scan: expected exactly one APK package, found 2

**Description** Fetch .apk from https://github.com/wolfi-dev/os/pull/39152/checks?check_run_id=36032861217 which implements https://systemd.io/ELF_PACKAGE_METADATA/ `wolfictl scan` on those fails like so: ``` wget https://apk.cgr.dev/wolfi-presubmit/6ae23109d7ecb9d4b9cf77cc9584575b09a63dd1/aarch64/scanelf-1.3.8-r2.apk wolfictl scan scanelf-1.3.8-r2.apk 🔎 Scanning "scanelf-1.3.8-r2.apk" 2025/01/23 02:47:55 ERRO failed to scan "scanelf-1.3.8-r2.apk": failed to scan APK: expected exactly one APK package, found 2 ``` Note the binary package name is scanelf, but the origin for it is pax-utils: ``` tar xf scanelf-1.3.8-r2.apk readelf --notes usr/bin/scanelf Displaying notes found in: .note.ABI-tag Owner Data size Description GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag) OS: Linux, ABI: 4.9.0 Displaying notes found in: .note.package Owner Data size Description FDO 0x00000060 FDO_PACKAGING_METADATA Packaging Metadata: {"type":"apk","os":"wolfi","name":"pax-utils","version":"1.3.8-r2","architecture":"aarch64"} ``` Note syft knows how to catalog that ``` syft usr/bin/scanelf ✔ Indexed file system usr/bin/scanelf ✔ Cataloged contents 437aa67b5123c73eb3bcb75c26bf3b27cd2abf3cfc59a3615309f718d876a946 ├── ✔ Packages [1 packages] ├── ✔ File digests [1 files] ├── ✔ File metadata [1 locations] └── ✔ Executables [1 executables] NAME VERSION TYPE pax-utils 1.3.8-r2 apk A newer version of syft is available for download: 1.19.0 (installed version is 1.18.1) ``` More details ``` $ wolfictl scan -vv scanelf-1.3.8-r2.apk 2025/01/23 10:26:30 DEBU checking cache for SBOM expectedPath=/home/xnox/.cache/wolfictl/sbom/apk/scanelf-1.3.8-r2-sha256-8f340707e80c5a4159c41ef40ed6d3e2dc052f806b5cfbf906b1ade9b575ab14.syft.json 2025/01/23 10:26:30 DEBU SBOM cache hit cachedPath=/home/xnox/.cache/wolfictl/sbom/apk/scanelf-1.3.8-r2-sha256-8f340707e80c5a4159c41ef40ed6d3e2dc052f806b5cfbf906b1ade9b575ab14.syft.json 🔎 Scanning "scanelf-1.3.8-r2.apk" 2025/01/23 10:26:31 DEBU scanning APK SBOM for vulnerabilities packageCount=2 2025/01/23 10:26:31 ERRO failed to scan "scanelf-1.3.8-r2.apk": failed to scan APK: expected exactly one APK package, found 2 ``` Which has ``` { "artifacts": [ { "id": "28c90cec071e0118", "name": "pax-utils", "version": "1.3.8-r2", "type": "apk", "foundBy": "elf-binary-package-cataloger", "locations": [ { "path": "usr/bin/scanelf", "accessPath": "usr/bin/scanelf", "annotations": { "evidence": "primary" } } ], "licenses": [], "language": "", "cpes": [ { "cpe": "cpe:2.3:a:pax-utils:pax-utils:1.3.8-r2:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:pax-utils:pax_utils:1.3.8-r2:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:pax_utils:pax-utils:1.3.8-r2:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:pax_utils:pax_utils:1.3.8-r2:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:pax:pax-utils:1.3.8-r2:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:pax:pax_utils:1.3.8-r2:*:*:*:*:*:*:*", "source": "syft-generated" } ], "purl": "pkg:apk/pax-utils@1.3.8-r2", "metadataType": "elf-binary-package-note-json-payload", "metadata": { "type": "apk", "architecture": "aarch64", "os": "wolfi" } }, { "id": "0b4aac8b80c2df13", "name": "scanelf", "version": "1.3.8-r2", "type": "apk", "foundBy": "wolfictl", "locations": [ { "path": ".PKGINFO", "accessPath": ".PKGINFO" } ], "licenses": [ { "value": "GPL-2.0-only", "spdxExpression": "GPL-2.0-only", "type": "declared", "urls": [], "locations": [] } ], "language": "", "cpes": [ { "cpe": "cpe:2.3:a:scanelf:scanelf:1.3.8-r2:*:*:*:*:*:*:*", "source": "syft-generated" } ], "purl": "pkg:apk/wolfi/scanelf@1.3.8-r2?arch=aarch64&origin=pax-utils", "metadataType": "apk-db-entry", "metadata": { "package": "scanelf", "originPackage": "pax-utils", "maintainer": "", "version": "1.3.8-r2", "architecture": "aarch64", "url": "", "description": "", "size": 340106, "installedSize": 0, "pullDependencies": [ "so:ld-linux-aarch64.so.1", "so:libc.so.6" ], "provides": [ "cmd:scanelf=1.3.8-r2" ], "pullChecksum": "efba6480c8c28321a737ec3c0fd87e05dbd27e556b02de91b31dadb3c9dae24e", "gitCommitOfApkPort": "6ae23109d7ecb9d4b9cf77cc9584575b09a63dd1", "files": [ { "path": "." }, { "path": ".PKGINFO" }, { "path": ".melange.yaml" }, { "path": "usr" }, { "path": "usr/bin" }, { "path": "usr/bin/scanelf" }, { "path": "var" }, { "path": "var/lib" }, { "path": "var/lib/db" }, { "path": "var/lib/db/sbom" }, { "path": "var/lib/db/sbom/scanelf-1.3.8-r2.spdx.json" } ] } } ], "artifactRelationships": [], "source": { "id": "(redacted for determinism)", "name": "scanelf", "version": "1.3.8-r2", "type": "directory", "metadata": { "path": "scanelf-1.3.8-r2.apk" } }, "distro": { "id": "wolfi" }, "descriptor": { "name": "wolfictl", "version": "" }, "schema": { "version": "16.0.18", "url": "https://raw.githubusercontent.com/anchore/syft/main/schema/json/schema-16.0.18.json" } } ``` I am hoping for this to just work. The packaging metadata we provide is similar to what other distributions do, i.e.: ``` # rpm -qf /usr/bin/udevadm systemd-udev-252.16-1.amzn2023.0.1.x86_64 # readelf --notes /usr/bin/udevadm | grep Packaging Packaging Metadata: {"type":"rpm","name":"systemd","version":"252.16-1.amzn2023.0.1","architecture":"x86_64","osCpe":"cpe:2.3:o:amazon:amazon_linux:2023"} ```