fix(sbom): preserve Red Hat BuildInfo when scanning SBOMs without layer info (aquasecurity#10378)

Author: DmitriyLewen

pkg/fanal/applier/docker.go

@@ -212,14 +212,17 @@ func ApplyLayers(layers []ftypes.BlobInfo) ftypes.ArtifactDetail {
 	}
 
 	for i, pkg := range mergedLayer.Packages {
-		// Skip lookup for SBOM
+		// Skip lookup for SBOMs obtained from container images (pkg.Layer is already set).
 		if lo.IsEmpty(pkg.Layer) {
 			originLayerDigest, originLayerDiffID, installedFiles, buildInfo := lookupOriginLayerForPkg(pkg, layers)
 			mergedLayer.Packages[i].Layer = ftypes.Layer{
 				Digest: originLayerDigest,
 				DiffID: originLayerDiffID,
 			}
-			mergedLayer.Packages[i].BuildInfo = buildInfo
+			// Do not overwrite BuildInfo if it is already set (e.g. packages from SBOMs generated by trivy rootfs).
+			if buildInfo != nil {
+				mergedLayer.Packages[i].BuildInfo = buildInfo
+			}
 			// Debian/Ubuntu has the installed files only in the first layer where the package is installed.
 			mergedLayer.Packages[i].InstalledFiles = installedFiles
 		}

pkg/fanal/applier/docker_test.go

@@ -1381,6 +1381,72 @@ func TestApplyLayers(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "SBOM generated by trivy rootfs preserves package-level BuildInfo",
+			inputLayers: []types.BlobInfo{
+				{
+					SchemaVersion: 1,
+					PackageInfos: []types.PackageInfo{
+						{
+							FilePath: "var/lib/rpm/Packages",
+							Packages: types.Packages{
+								{
+									Name:    "openssl",
+									Version: "1.2.3",
+									Release: "4",
+									// pkg.Layer is empty: packages in SBOM files do not contain
+									// layer information (e.g. SBOMs generated via trivy rootfs).
+									// BuildInfo is already set from the SBOM content sets.
+									BuildInfo: &types.BuildInfo{
+										ContentSets: []string{
+											"rhel-8-for-x86_64-baseos-eus-rpms__8_DOT_4",
+										},
+									},
+								},
+							},
+						},
+					},
+					OS: types.OS{
+						Family: "redhat",
+						Name:   "8",
+					},
+				},
+			},
+			want: types.ArtifactDetail{
+				OS: types.OS{
+					Family: "redhat",
+					Name:   "8",
+				},
+				Packages: types.Packages{
+					{
+						Name:    "openssl",
+						Version: "1.2.3",
+						Release: "4",
+						Identifier: types.PkgIdentifier{
+							UID: "d56a873f2b8d0fae",
+							PURL: &packageurl.PackageURL{
+								Type:      packageurl.TypeRPM,
+								Namespace: "redhat",
+								Name:      "openssl",
+								Version:   "1.2.3-4",
+								Qualifiers: packageurl.Qualifiers{
+									{
+										Key:   "distro",
+										Value: "redhat-8",
+									},
+								},
+							},
+						},
+						// BuildInfo must be preserved, not overwritten with nil.
+						BuildInfo: &types.BuildInfo{
+							ContentSets: []string{
+								"rhel-8-for-x86_64-baseos-eus-rpms__8_DOT_4",
+							},
+						},
+					},
+				},
+			},
+		},
 		{
 			name: "same package but different file path", // different hashes
 			inputLayers: []types.BlobInfo{