Support new os name(CentOS Stream) on CentOS

[srinivasKandukuri]

Description

We need to support new OS "CentOS Stream"

As of now we are supporting the CentOS, CentOS Linux
https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/analyzer/os/redhatbase/centos.go#L36

Desired Behavior

When we scan image which is related to CentOS Stream it should detect the OS and give the result's.

Ex: dokken/centos-stream-9

Actual Behavior

If we scan the image related to CentOS stream image OS is not detecting.

Reproduction Steps

1.Scan this docker image  "dokken/centos-stream-9" 
2.logs are showing below messages
 Detected os : none
 WARN    unsupported os : none
...

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Client/Server

Debug Output

Client
-----------
WARNING: undefined behavior - version of Delve is too old for Go version 1.19.0 (maximum supported version 1.18)
2023-06-05T15:30:35.537+0530    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-06-05T15:30:35.538+0530    INFO    Vulnerability scanning is enabled
2023-06-05T15:30:35.538+0530    DEBUG   Vulnerability type:  [os library]
2023-06-05T15:30:35.538+0530    INFO    Secret scanning is enabled
2023-06-05T15:30:35.538+0530    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-06-05T15:30:35.538+0530    INFO    Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection
2023-06-05T15:30:38.239+0530    DEBUG   No secret config detected: trivy-secret.yaml
2023-06-05T15:30:39.063+0530    DEBUG   Image ID: sha256:3b86023010f3ec35a768b261371760c9520f4bc28bf39928acfb49cce2a92ae1
2023-06-05T15:30:39.063+0530    DEBUG   Diff IDs: [sha256:071ff3277e631c73dfe5c5a077fa3064f35cbe5c09546b9760130370bf115293 sha256:5e89e9345ab8c41503ec594c9ad47a40aa405c7c690e75b4a50e1dc76a25a66a]
2023-06-05T15:30:39.063+0530    DEBUG   Base Layers: []
2023-06-05T15:30:39+05:30 error layer=debugger error loading binary "/lib/x86_64-linux-gnu/libc.so.6": could not parse .eh_frame section: pointer encoding not supported 0x9b at 0x59f4
2023-06-05T15:30:44.305+0530    DEBUG   Missing image ID in cache: sha256:3b86023010f3ec35a768b261371760c9520f4bc28bf39928acfb49cce2a92ae1
2023-06-05T15:30:46.414+0530    DEBUG   Missing diff ID in cache: sha256:071ff3277e631c73dfe5c5a077fa3064f35cbe5c09546b9760130370bf115293
2023-06-05T15:30:46.415+0530    DEBUG   Missing diff ID in cache: sha256:5e89e9345ab8c41503ec594c9ad47a40aa405c7c690e75b4a50e1dc76a25a66a
2023-06-05T15:31:43.649+0530    DEBUG   No secrets found in container image config



Server
-------
2023-06-05T15:29:10.156+0530    DEBUG   cache dir:  /home/sk/.cache/trivy
2023-06-05T15:29:10.157+0530    INFO    Listening 0.0.0.0:8085...
2023-06-05T15:31:43+05:30 error layer=debugger error loading binary "/lib/x86_64-linux-gnu/libc.so.6": could not parse .eh_frame section: pointer encoding not supported 0x9b at 0x59f4
2023-06-05T15:31:47.706+0530    DEBUG   OS is not detected.
2023-06-05T15:31:47.706+0530    INFO    Detected OS: none
2023-06-05T15:31:47.706+0530    WARN    unsupported os : none
2023-06-05T15:31:47.706+0530    INFO    Number of language-specific files: 0

Operating System

Ubuntu

Version

0.36.1

Checklist

• Run trivy --reset
• Read the troubleshooting

[knqyf263]

We need security advisories for CentOS Stream. Do they distribute that?

[ankk13]

No. We do not have any Security Advisory for centos steam. But as per https://centos.org/distro-faq/#q4-how-will-cves-be-handled-in-centos-stream, we can refer parent RHEL's security advisory. We will have to explore more around this.

[knqyf263]

Interesting. This is my understanding.

I thought the updates would come to CentOS Stream first.

Let’s say you’re a Red Hat Enterprise Linux user who has identified a change that is needed in the next version. You can propose that change to CentOS Stream for Red Hat developers to evaluate. If accepted, your change is tested, verified, and will land in CentOS Stream, and the change will be in the next minor release of Red Hat Enterprise Linux.

https://www.redhat.com/en/topics/linux/what-is-centos-stream