Inventory packages on AWS Linux root volumes

[om986]

Summary

• Add om scan workload for Phase 4 (#102). It runs as root on an EC2 instance in the account, snapshots each Linux root volume, mounts the copy read-only, and writes CPE 2.3 names and package URLs onto the existing workload.
• om scan aws stays a read-only API scan. A later API scan keeps packages. Snapshots and volumes are deleted when the read finishes, including on failure, and are tagged opensourceom:scan=workload.
• Windows instances, LVM roots, and non-root disks are skipped. The graph stores package identifiers only.

Test plan

• go test ./... with TEST_DATABASE_URL set
• On an EC2 worker, run om scan aws, then sudo -E ./om scan workload, then om enrich cve, and confirm a CVE attaches only when an identifier matches
• Fail a read on purpose and confirm the snapshot and volume are deleted
• Run om scan aws again and confirm packages are still on the workload
• Confirm a Windows instance and an LVM root are skipped

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: OpenSourceOM/core/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: aa50b08b-9390-44ac-9baf-86dbe8dcba37

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}