Trivy image vs fs on dotnet differs when expecting the same results.

[jmonsma]

Hi,

Im trying to reduce some toil by using trivy image soly for scanning CVE's. Current we are running filesystem and image together. This produces different results. One difference is expected because the image OS is also scanned with runnign trivy image. The other difference is for use questionable. Hope you guys can give me an explanation why, or is it a bug?

We are running a dotnetcore 8 application installed with a package.lock.json. Running trivy fs on the application directory it produces some CVE's result-fs.txt
One about Newtonsoft the others about System packages.

While making our docker image we we run dotnet restore and dotnet publish to compile our application and delive a running application. When running trivy image it delivers only one CVE.
result-image.txt

The image scan looks at a different file, that im aware of. But even in the *.deps.json file. The same system packages are found as well compared to the lock file. Even System.Net.Http is listed as dependencies of the application but that does not make any differences.

Does trivy ignore system packages, even while they are actively used in the code? See below the program that is ran and also the packages.lock.json file and the deps.json file

HelloWorld.deps.json
packages.lock.json

using System;
using System.Net.Http;
using System.Text.RegularExpressions;
using System.Threading.Tasks;
class Program
{
    static async Task Main(string[] args)
    {
        using HttpClient client = new HttpClient();
        Regex.Match("Test","t");
        Console.WriteLine("Hello, World!");

        try
        {
            string url = "https://google.com";
            HttpResponseMessage response = await client.GetAsync(url);
            response.EnsureSuccessStatusCode();
            
            string responseBody = await response.Content.ReadAsStringAsync();
            Console.WriteLine(responseBody);
        }
        catch (HttpRequestException e)
        {
            Console.WriteLine($"Request error: {e.Message}");
        }
    }
}