Does an inventory.json / application.json exists?

[jkroepke]

Hi there,

9 of 10 OS vulnerability scanner / inventory scraper using available package database like rpm/deb/apk ...

Since Flatcar is an immutable operating system, there is no such package database. But having a machine readable inventory of all installed packages would be great to gain an overview which software is inside Flatcar release.

Amazons immutable OS Distribution Bottlerocket recently introduced a application.json contains all installed packages. Since the system is immutable, too. A pre build static json file fits here.

https://www.linuxadictos.com/en/bottlerocket-1-7-0-arrives-with-updates-and-fixes-a-bug-with-nvidia-drivers.html#Que_hay_de_nuevo_enBottlerocket_170

Question: Does something similar exists in Flatcar?

[tormath1]

Hi @jkroepke , that's an interesting question. Please find these two links:

• https://alpha.release.flatcar-linux.net/amd64-usr/current/flatcar_production_image_packages.txt to get list of installed packages on alpha
• https://alpha.release.flatcar-linux.net/amd64-usr/current/flatcar_production_image_contents.txt to get content of the image on alpha

Of course, you can decline the links in the following way:

• https://(alpha|beta|stable).release.flatcar-linux.net/(amd64-usr|arm64-usr)/(current|VERSION)/flatcar_production_image_contents.txt to get content of the image

I hope it answers to your question.

[jkroepke]

Hi @tormath1

thanks. Yes this help at the beginning.

I have two additional questions:

1. is it also possible distribute the txt file as part of Flatcar itself? For example /usr/share/flatcar/packages.txt?

2. It looks like, vendor specific extensions are missing in the packages.txt, for example the EC2 AMIs contains app-emulation/amazon-ssm-agent, but it's not listed on the flatcar_production_image_packages.txt. This is expected?

[tormath1]

I'm glad it helped you. Regarding your two points:

1. Do you have any use-cases in mind ? Except for offline instances, I think downloading the flatcar_production_image_contents.txt would be enough ? Since you have the channel and the version of the instance, you can build the URL.
2. app-emulation/amazon-ssm-agent is part of the AWS OEM and OEM packages are installed after the flatcar_production_image_packages.txt creation - this file contains packages non-vendor specifics.

[jkroepke]

would be enough?

Yes I agree. It would be enough for my use case here. It maybe solves my problem here.

But I'm also interest to solve this upstream, in case the Flatcar is interest into it.

My vision here:

Many enterprise companies (I can only speak for germans here) have a requirement to gather the software inventory from each running VM. Currently, I'm able to write a script which curls the packages.txt to the running VM. This is okay. But everybody has to do this.

In case, Flatcar would deliver this file inside the /usr as part of the distribution itself in a standardised way, tools like https://github.com/aquasecurity/trivy, https://github.com/aws/amazon-ssm-agent, e.g can be adjusted upstream to read the file and populate the software inventory of such files.

The next step would be a vulnerability reporting based on installed packages inside Flatcar. I'm not expect that Flatcar is starting the setup a own vulnerability database, but Flatcar can be handled as Gentoo-like and could benefit from https://security.gentoo.org/.