fix(sbom): detect OS from purl if OS component not found

[DmitriyLewen]

Description

There are cases when SBOM file doesn't contain OS component.
To avoid missing OS packages -we can try to get OS from purl.
More details - #7073 (reply in thread)

Related issues

• Close fix(sbom): detect OS from purl if OS component not found #7100

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I thought about it.
We can leave this error.

But if we get problems about this - we will update the logic to get the OS (from purl) with the maximum number of packages.

[eshafaq1]

@DmitriyLewen thank you for creating this PR, I too am seeing a lot of warnings when scanning wolfi images.

Question unrelated to PR: For these warning you mention in discussions/7073, is Trivy unable to scan the packages in the image therefore being unable to report accurate vulnerability info for Wolfi images?

[DmitriyLewen]

Hello @eshafaq1

is Trivy unable to scan the packages in the image therefore being unable to report accurate vulnerability info for Wolfi images?

Trivy detects the following packages from wolfi images:

1. apk packages obtained from lib/apk/db/installed file (default way to detect apk packages)
2. packages from SBOM files (this PR for these packages).

IIUC packages from p1 and p2 is same (duplicates).
So you shouldn't have problem, because Trivy correctly detectы vulnerabilities for packages from p1.

[eshafaq1]

Hopefully @knqyf263 can get some time to review :)

[github-actions]

This PR is stale because it has been labeled with inactivity.