AWS inspector: Add Mozilla ecosystem collection to SBOM generator docs
Summary
Added a new 'Mozilla ecosystem collection' section documenting how the Amazon Inspector SBOM Generator parses application.ini for Firefox, Firefox ESR, and Thunderbird, including supported paths, limitations, and example PURLs; also added Mozilla to the supported ecosystems list.
Security assessment
The change documents a new SBOM generator capability that inventories Mozilla applications so they can be assessed for vulnerabilities; it describes a security/vulnerability-assessment feature rather than fixing a specific vulnerability or incident.
Evidence
+## Mozilla ecosystem collection
Diff
diff --git a/inspector/latest/user/sbom-generator-ecosystem-collection.md b/inspector/latest/user/sbom-generator-ecosystem-collection.md index c68d156e8..ce81c97c2 100644 --- a//inspector/latest/user/sbom-generator-ecosystem-collection.md +++ b//inspector/latest/user/sbom-generator-ecosystem-collection.md @@ -7 +7 @@ -Supported ecosystems7-Zip ecosystem collectionAI Agent Skills ecosystem collectionAI IDE extensions ecosystem collectionAmazon Q Developer ecosystem collectionApache ecosystem collectionAtlassian ecosystem collectionClaude Code ecosystem collectionConda ecosystem collectionCurl ecosystem collectionCursor ecosystem collectionDocker binaries ecosystem collectionElasticsearch ecosystem collectionGeneric AI/ML Models ecosystem collectionGitHub Copilot ecosystem collectionGoogle ecosystem collectionHuggingFace ecosystem collectionJava ecosystem collectionJenkins ecosystem collectionKiro CLI ecosystem collectionMariaDB and MySQL ecosystem collectionMicrosoft applications ecosystem collectionMicrosoft SQL Server ecosystem collectionMongoDB ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOllama ecosystem collectionOllama Model Collector ecosystem collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionPHP ecosystem collectionRedis ecosystem collectionStandalone AI applications ecosystem collectionWindsurf ecosystem collectionWordPress ecosystem collectionZed ecosystem collection +Supported ecosystems7-Zip ecosystem collectionAI Agent Skills ecosystem collectionAI IDE extensions ecosystem collectionAmazon Q Developer ecosystem collectionApache ecosystem collectionAtlassian ecosystem collectionClaude Code ecosystem collectionConda ecosystem collectionCurl ecosystem collectionCursor ecosystem collectionDocker binaries ecosystem collectionElasticsearch ecosystem collectionGeneric AI/ML Models ecosystem collectionGitHub Copilot ecosystem collectionGoogle ecosystem collectionHuggingFace ecosystem collectionJava ecosystem collectionJenkins ecosystem collectionKiro CLI ecosystem collectionMariaDB and MySQL ecosystem collectionMicrosoft applications ecosystem collectionMicrosoft SQL Server ecosystem collectionMongoDB ecosystem collectionMozilla ecosystem collectionNginx ecosystem collectionNode.JS runtime collectionOllama ecosystem collectionOllama Model Collector ecosystem collectionOpenSSH ecosystem collectionOpenSSL ecosystem CollectionOracle Database Server collectionPHP ecosystem collectionRedis ecosystem collectionStandalone AI applications ecosystem collectionWindsurf ecosystem collectionWordPress ecosystem collectionZed ecosystem collection @@ -1919,0 +1920,106 @@ The following is an example package URL for MongoDB Server. +## Mozilla ecosystem collection + +###### Supported applications + + * Firefox + + * Firefox ESR + + * Thunderbird + + + + +###### Key features + + * Parses the `application.ini` manifest that ships with Mozilla applications. The parser reads only the `[App]` section and stops at the next section header, so keys from other sections, such as `[Gecko]`, are ignored. + + * Identifies the product from the `RemotingName` field, which resolves to `firefox`, `firefox-esr`, or `thunderbird`. `RemotingName` is used instead of `Name` because the `Name` field is `Firefox` for both the release and ESR channels. + + * Extracts the version verbatim from the `Version` field. Both `RemotingName` (matching a known product) and `Version` are required. If either is missing, or the `RemotingName` value is not a known Mozilla product, no component is reported. This excludes non-Mozilla Gecko applications that also ship an `application.ini` file. + + * Detected applications are reported as CycloneDX components with the `application` type. + + * Records the `SourceRepository` value as the CycloneDX property `amazon:inspector:sbom_generator:mozilla:source_repository` rather than as a package URL qualifier, so it doesn't affect vulnerability identification. + + + + +###### Supported platforms + +The Amazon Inspector SBOM Generator discovers `application.ini` files by name with the following default paths across platforms: + +###### Linux + + * `/usr/lib/firefox/`, `/usr/lib/firefox-esr/`, `/usr/lib/thunderbird/` + + * `/usr/lib64/firefox/`, `/usr/lib64/thunderbird/` + + * `/opt/firefox/`, `/opt/thunderbird/` + + * `/usr/local/lib/firefox/`, `/usr/local/lib/thunderbird/` + + + + +###### macOS + + * `/Applications/Firefox.app/Contents/Resources/` + + * `/Applications/Thunderbird.app/Contents/Resources/` + + + + +###### Windows + + * `C:\Program Files\Mozilla Firefox\`, `C:\Program Files (x86)\Mozilla Firefox\` + + * `C:\Program Files\Mozilla Thunderbird\`, `C:\Program Files (x86)\Mozilla Thunderbird\` + + + + +###### Limitations + + * Installations in non-default paths aren't on the default localhost scan list. To scan them, use the `--path` option to run a directory scan. + + * Snap and Flatpak packages of Firefox and Thunderbird aren't supported. + + * Installations from an OS package manager are detected if they contain an `application.ini` file. These installations are also reported by the operating system package collectors. + + + + +###### Example `application.ini` file + +The following is an example of content inside an `application.ini` file for a Firefox ESR installation. + + + //truncated + + [App] + Vendor=Mozilla + Name=Firefox + RemotingName=firefox-esr + Version=140.14.0 + SourceRepository=https://hg.mozilla.org/releases/mozilla-esr140 + + //truncated + +The product `firefox-esr` is taken from the `RemotingName` field, and version `140.14.0` is taken from the `Version` field. + +###### Example PURL + +The following are example package URLs for Mozilla applications. + + + // Firefox + pkg:generic/mozilla/[email protected]?distro=darwin + + // Firefox ESR + pkg:generic/mozilla/[email protected]?distro=linux + + // Thunderbird + pkg:generic/mozilla/[email protected]?distro=darwin +