@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/inventory/source.js

@@ -30,6 +30,7 @@ import {
   prefetchedResponse,
   prefetchJson,
 } from "./fetchBatch.js";
+import { mavenCentralFetchUrl } from "./mavenCentralMirror.js";
 import { canonicalPurlFromLooseString } from "./purl.js";
 
 /** Raised when a caller omits a registry helper that the purl type requires. */
@@ -795,6 +796,48 @@ export function getGitRemoteHost(remote) {
   return host.toLowerCase();
 }
 
+/**
+ * Remove credentials from git output before it is logged. Every URL in the
+ * text loses its user name and password, which git copies into its error
+ * messages from the remote it was given.
+ *
+ * @param {string|undefined} text Output of a git command
+ * @param {string|undefined} repoUrl Remote the command was given
+ * @returns {string|undefined} Output with credentials replaced by ***
+ */
+export function redactGitOutput(text, repoUrl) {
+  if (!text || typeof text !== "string") {
+    return text;
+  }
+  let redacted = text;
+  if (repoUrl && typeof repoUrl === "string") {
+    redacted = redacted.split(repoUrl).join(sanitizeRemoteUrlForLogs(repoUrl));
+  }
+  let from = 0;
+  while (from < redacted.length) {
+    const schemeEnd = redacted.indexOf("://", from);
+    if (schemeEnd === -1) {
+      break;
+    }
+    const authorityStart = schemeEnd + 3;
+    let authorityEnd = authorityStart;
+    while (
+      authorityEnd < redacted.length &&
+      !"/?#'\"<> \t\r\n".includes(redacted[authorityEnd])
+    ) {
+      authorityEnd++;
+    }
+    const at = redacted.lastIndexOf("@", authorityEnd - 1);
+    if (at >= authorityStart) {
+      redacted = `${redacted.slice(0, authorityStart)}***:***${redacted.slice(at)}`;
+      from = authorityStart + "***:***".length;
+    } else {
+      from = authorityEnd;
+    }
+  }
+  return redacted;
+}
+
 /**
  * Clone a git repository into a temporary directory.
  *
@@ -859,8 +902,11 @@ export function gitClone(repoUrl, branch = null) {
     `Cloning Repo${branch ? ` with branch ${branch}` : ""} to ${tempDir}`,
   );
   const result = hardenedGitCommand(gitArgs);
-  if (result.status !== 0) {
-    console.error(result.stderr);
+  if (result.status !== 0 || result.error) {
+    console.error(redactGitOutput(result.stderr, repoUrl));
+    // The directory was created by this call, so it is always safe to remove.
+    safeRmSync(tempDir, { recursive: true, force: true });
+    throw new Error("Git clone failed.");
   }
 
   return tempDir;
@@ -1588,6 +1634,7 @@ export async function resolveGitUrlFromPurl(purlString, helpers = {}) {
           break;
         }
         const mavenCentralUrl =
+          mavenCentralFetchUrl() ||
           readEnvironmentVariable("MAVEN_CENTRAL_URL") ||
           "https://repo1.maven.org/maven2/";
         registry = mavenCentralUrl.endsWith("/")

package/lib/managers/binary.js

@@ -38,14 +38,24 @@ import {
   safeRmSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { thoughtLog } from "../core/logger.js";
 import { mapWithConcurrency } from "../core/parallel.js";
 import { isValidDriveRoot } from "../core/paths.js";
 import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
+import {
+  attachBrotliDecoder,
+  createBrotliInventory,
+  finishBrotliInventory,
+  MAX_BROTLI_PROBE_BYTES,
+  MAX_BROTLI_PROBES,
+  readBrotliDecoder,
+} from "../inventory/brotliDecoder.js";
 import {
   CertificateCollector,
   classifyCryptoFile,
 } from "../inventory/certificates.js";
 import { createContainerRiskProperties } from "../inventory/containerRisk.js";
+import { collectDotnetRuntimes } from "../inventory/dotnetRuntime.js";
 import {
   attachIdentityTools,
   extractToolRefs,
@@ -55,6 +65,13 @@ import {
   readGoBuildVersion,
 } from "../inventory/goBuildInfo.js";
 import { createGtfoBinsProperties } from "../inventory/gtfobins.js";
+import {
+  attachNodeBuild,
+  createNodeRuntimeInventory,
+  isNodeBinaryName,
+  MAX_NODE_PROBES,
+  readNodeBuildVersion,
+} from "../inventory/nodeBuildInfo.js";
 import {
   canonicalDistroQualifier,
   getDistroInfo,
@@ -66,6 +83,7 @@ import {
 import { isRealArchitecture } from "../inventory/osPackagePurl.js";
 import {
   collectExecutables,
+  collectNativeExtensions,
   collectSharedLibs,
 } from "../inventory/osPackageResolver.js";
 import {
@@ -87,6 +105,15 @@ import {
   tryBuildPurl,
 } from "../inventory/purl.js";
 import { collectRootfsCertificates } from "../inventory/rootfsCerts.js";
+import {
+  attachRubyBuild,
+  createRubyRuntimeInventory,
+  deriveOsPackagedRubyRuntimes,
+  isLibrubyName,
+  isRubyBinaryName,
+  MAX_RUBY_PROBES,
+  readRubyBuildVersion,
+} from "../inventory/rubyBuildInfo.js";
 import {
   adjustLicenseInformation,
   findLicenseId,
@@ -538,6 +565,15 @@ const COMMON_RUNTIMES = [
   "openjdk25-jre",
 ];
 
+// Runtime packages whose name carries the series, such as Debian's ruby3.1
+// and libruby3.1, openSUSE's libruby3_4-3_4 and Wolfi's ruby-3.3.
+const VERSIONED_RUNTIME_PATTERNS = [
+  /^(lib)?ruby\d+\.\d+(t64)?$/,
+  /^ruby-\d+\.\d+$/,
+  /^ruby-libs$/,
+  /^libruby\d+_\d+-\d+_\d+$/,
+];
+
 /**
  * Run the `cargo-auditable` companion binary against the given source path and
  * return its stdout.
@@ -829,7 +865,7 @@ export function dropRedundantSourceComponents(pkgList) {
   const installedPurls = new Set();
   for (const comp of pkgList) {
     if (comp?.purl && !comp?.tags?.includes("source")) {
-      installedPurls.add(comp.purl);
+      installedPurls.add(withoutArch(comp.purl));
     }
   }
   if (!installedPurls.size) {
@@ -837,13 +873,33 @@ export function dropRedundantSourceComponents(pkgList) {
   }
   for (let i = pkgList.length - 1; i >= 0; i--) {
     const comp = pkgList[i];
-    if (comp?.tags?.includes("source") && installedPurls.has(comp.purl)) {
+    if (
+      comp?.tags?.includes("source") &&
+      installedPurls.has(withoutArch(comp.purl))
+    ) {
       pkgList.splice(i, 1);
     }
   }
   return pkgList;
 }
 
+// The arch qualifier deb and rpm purls give a source package.
+const SOURCE_PACKAGE_ARCH = { deb: "source", rpm: "src" };
+
+// A source shadow is named like an installed package of the same name and
+// version, whatever arch either names, so arch is left out of the comparison.
+function withoutArch(purl) {
+  const [base, query] = `${purl}`.split("?");
+  if (!query) {
+    return base;
+  }
+  const kept = query
+    .split("&")
+    .filter((pair) => !pair.startsWith("arch="))
+    .sort();
+  return kept.length ? `${base}?${kept.join("&")}` : base;
+}
+
 /**
  * Get the packages installed in the container image filesystem.
  *
@@ -1346,6 +1402,14 @@ export async function getOSPackages(src, imageConfig, options = {}) {
                 if (epoch) {
                   newCompQualifiers.epoch = epoch;
                 }
+                // A source package is built for no architecture. The deb and
+                // rpm purl types name it `source` and `src`; copying the arch
+                // of whichever binary led here (`all` from a -doc package)
+                // misnames it.
+                const sourceArch = SOURCE_PACKAGE_ARCH[purlObj.type];
+                if (sourceArch && newCompQualifiers.arch) {
+                  newCompQualifiers.arch = sourceArch;
+                }
                 newComp.purl = build({
                   type: purlObj.type,
                   namespace: purlObj.namespace || null,
@@ -1381,6 +1445,7 @@ export async function getOSPackages(src, imageConfig, options = {}) {
     components: ownedFileComponents,
     dependenciesList: ownedFileDependencies,
     ownedFilePaths,
+    ownerByPath,
     services: ownedServices,
   } = await createOSPackageFileComponents(src, osPackageEntries);
   if (ownedFileComponents.length) {
@@ -1455,9 +1520,61 @@ export async function getOSPackages(src, imageConfig, options = {}) {
   if (phpBuildInventory.dependencies.length) {
     dependenciesList.push(...phpBuildInventory.dependencies);
   }
+  // Node.js from the Docker Official images, the release tarballs, nvm, fnm or
+  // volta is unpackaged, so its version is only visible in the binary.
+  const nodeBuildInventory = collectNodeBuildInfo(executables, sharedLibs, src);
+  if (nodeBuildInventory.runtimeComponents.length) {
+    pkgList.push(...nodeBuildInventory.runtimeComponents);
+  }
+  if (nodeBuildInventory.dependencies.length) {
+    dependenciesList.push(...nodeBuildInventory.dependencies);
+  }
+  // Ruby from the Docker Official images, ruby-build, rbenv, rvm, asdf, mise
+  // or chruby is unpackaged; its version is in rbconfig.rb and libruby.
+  const rubyBuildInventory = collectRubyBuildInfo(executables, sharedLibs, src);
+  if (rubyBuildInventory.runtimeComponents.length) {
+    pkgList.push(...rubyBuildInventory.runtimeComponents);
+  }
+  if (rubyBuildInventory.dependencies.length) {
+    dependenciesList.push(...rubyBuildInventory.dependencies);
+  }
+  // A Ruby an OS package installed is named by that package; it also gets
+  // its upstream identity, without a CPE, so a BOM names the interpreter both
+  // ways.
+  pkgList.push(...deriveOsPackagedRubyRuntimes(pkgList));
+  // The .NET images and dotnet-install.sh put the runtime under a dotnet root
+  // without a package manager; its deps.json names the runtime pack.
+  const dotnetRuntimes = collectDotnetRuntimes(src, ownedFilePaths);
+  if (dotnetRuntimes.length) {
+    pkgList.push(...dotnetRuntimes);
+    for (const runtime of dotnetRuntimes) {
+      dependenciesList.push({ ref: runtime["bom-ref"], dependsOn: [] });
+    }
+  }
+  // A Brotli decoder compiled into a native file that no package manager owns
+  // (Node.js, Python wheels, PHP and Ruby extensions, the .NET runtime, static
+  // binaries) is only visible by reading the file.
+  const brotliInventory = await collectBrotliDecoders(
+    executables,
+    sharedLibs,
+    src,
+    ownedFilePaths,
+  );
+
+  if (brotliInventory.components.length) {
+    pkgList.push(...brotliInventory.components);
+  }
+  if (brotliInventory.dependencies.length) {
+    dependenciesList.push(...brotliInventory.dependencies);
+  }
   return {
     osPackages: pkgList,
     osPackageFiles,
+    // Extension modules that carry a Brotli decoder. They are reported apart
+    // from sharedLibs so the unpackaged-library count still counts what the
+    // loader's directories hold.
+    nativeExtensionFiles: brotliInventory.extensionFiles,
+    ownerByPath,
     dependenciesList,
     allTypes: Array.from(allTypes).sort(),
     bundledSdks: Array.from(bundledSdks).sort(),
@@ -2696,6 +2813,7 @@ async function createOSPackageFileComponents(basePath, osPackageEntries) {
   const components = [];
   const dependenciesList = [];
   const ownedFilePaths = new Set();
+  const ownerByPath = new Map();
   const services = [];
   const componentByPath = new Map();
   for (const packageEntry of osPackageEntries) {
@@ -2706,6 +2824,10 @@ async function createOSPackageFileComponents(basePath, osPackageEntries) {
         continue;
       }
       ownedFilePaths.add(filePath);
+      const ownerKey = filePath.replaceAll("\\", "/").replace(/^\/+/, "");
+      if (!ownerByPath.has(ownerKey)) {
+        ownerByPath.set(ownerKey, packageEntry.packageRef);
+      }
       let fileComponent = componentByPath.get(filePath);
       if (!fileComponent) {
         fileComponent = await createOSPackageFileComponent(
@@ -2744,6 +2866,7 @@ async function createOSPackageFileComponents(basePath, osPackageEntries) {
     components,
     dependenciesList,
     ownedFilePaths: Array.from(ownedFilePaths).sort(),
+    ownerByPath,
     services: dedupeServices(services),
   };
 }
@@ -3229,7 +3352,10 @@ function detectSdksRuntimes(comp, bundledSdks, bundledRuntimes) {
     bundledRuntimes.add(comp.name);
   }
   // TODO: Need to test this for a range of base images
-  if (COMMON_RUNTIMES.includes(comp.name)) {
+  if (
+    COMMON_RUNTIMES.includes(comp.name) ||
+    VERSIONED_RUNTIME_PATTERNS.some((pattern) => pattern.test(comp.name))
+  ) {
     bundledRuntimes.add(comp.name);
   }
 }
@@ -3819,6 +3945,214 @@ function collectPhpBuildInfo(executables, sharedLibs, basePath) {
   };
 }
 
+/**
+ * Read the Node.js build version of each node-named executable and libnode
+ * shared library, add the cdx:node:* properties, and link the components to
+ * one platform component per distinct version. Mutates the components in
+ * place, as the PHP collector does.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{runtimeComponents: Object[], dependencies: Object[]}}
+ */
+function collectNodeBuildInfo(executables, sharedLibs, basePath) {
+  const inventory = createNodeRuntimeInventory();
+  let probes = 0;
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    if (probes >= MAX_NODE_PROBES) {
+      break;
+    }
+    const srcFile = component?.properties?.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile || !(isNodeBinaryName(srcFile) || isLibnode(srcFile))) {
+      continue;
+    }
+    if (packageStoreOf(srcFile)) {
+      continue;
+    }
+    probes += 1;
+    const build = readNodeBuildVersion(
+      join(basePath, srcFile.replace(/^\/+/, "")),
+      basePath,
+    );
+    if (build) {
+      attachNodeBuild(inventory, component, build);
+    }
+  }
+  return {
+    runtimeComponents: inventory.runtimeComponents,
+    dependencies: inventory.dependencies,
+  };
+}
+
+/**
+ * Read the Ruby build version of each unpackaged ruby executable and libruby
+ * shared library, add the cdx:ruby:* properties, and link the components to
+ * one platform component per distinct version. Mutates the components in
+ * place, as the PHP and Node.js collectors do.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{runtimeComponents: Object[], dependencies: Object[]}}
+ */
+function collectRubyBuildInfo(executables, sharedLibs, basePath) {
+  const inventory = createRubyRuntimeInventory();
+  let probes = 0;
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    if (probes >= MAX_RUBY_PROBES) {
+      break;
+    }
+    const srcFile = component?.properties?.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile || !(isRubyBinaryName(srcFile) || isLibrubyName(srcFile))) {
+      continue;
+    }
+    if (packageStoreOf(srcFile)) {
+      continue;
+    }
+    probes += 1;
+    const build = readRubyBuildVersion(
+      join(basePath, srcFile.replace(/^\/+/, "")),
+      basePath,
+    );
+    if (build) {
+      attachRubyBuild(inventory, component, build);
+    }
+  }
+  return {
+    runtimeComponents: inventory.runtimeComponents,
+    dependencies: inventory.dependencies,
+  };
+}
+
+function isLibnode(srcFile) {
+  const name = basename(srcFile.replaceAll("\\", "/"));
+  return /^libnode\.so(\.\d+)*$/.test(name);
+}
+
+/**
+ * Probe unpackaged executables, shared libraries and native extension modules
+ * for a compiled-in Brotli decoder. Executables and libraries already have file
+ * components and are tagged in place; an extension module becomes a file
+ * component only when it carries a decoder, so the BOM does not grow by every
+ * extension in the image. Executables and libraries, and extension modules,
+ * each get MAX_BROTLI_PROBES files, and the scan reads at most
+ * MAX_BROTLI_PROBE_BYTES in all; what a cap leaves unread is logged and
+ * recorded as the binary.brotli-probe.capped degradation.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @param {string[]} ownedFilePaths root-relative paths owned by OS packages
+ * @returns {Promise<{components: Object[], dependencies: Object[], extensionFiles: Object[]}>}
+ */
+async function collectBrotliDecoders(
+  executables,
+  sharedLibs,
+  basePath,
+  ownedFilePaths,
+) {
+  const inventory = createBrotliInventory();
+  let bytesRead = 0;
+  const unread = { files: 0, extensions: 0 };
+  const probe = (relativePath) => {
+    if (bytesRead >= MAX_BROTLI_PROBE_BYTES) {
+      return undefined;
+    }
+    const decoder = readBrotliDecoder(join(basePath, relativePath), basePath);
+    if (decoder && !decoder.skipped) {
+      bytesRead += decoder.size || 0;
+    }
+    return decoder;
+  };
+  let probes = 0;
+  const seenPaths = new Set();
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    const srcFile = component?.properties?.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile) {
+      continue;
+    }
+    const relativePath = srcFile.replaceAll("\\", "/").replace(/^\/+/, "");
+    seenPaths.add(relativePath);
+    if (packageStoreOf(relativePath)) {
+      continue;
+    }
+    if (probes >= MAX_BROTLI_PROBES || bytesRead >= MAX_BROTLI_PROBE_BYTES) {
+      unread.files += 1;
+      continue;
+    }
+    probes += 1;
+    const decoder = probe(relativePath);
+    if (decoder) {
+      attachBrotliDecoder(inventory, component, decoder);
+    }
+  }
+  const extensionHits = [];
+  let extensionProbes = 0;
+  for (const relativePath of collectNativeExtensions(basePath, [
+    ...(ownedFilePaths || []),
+    ...seenPaths,
+  ])) {
+    if (packageStoreOf(relativePath)) {
+      continue;
+    }
+    if (
+      extensionProbes >= MAX_BROTLI_PROBES ||
+      bytesRead >= MAX_BROTLI_PROBE_BYTES
+    ) {
+      unread.extensions += 1;
+      continue;
+    }
+    extensionProbes += 1;
+    const decoder = probe(relativePath);
+    if (decoder?.c || decoder?.go || decoder?.skipped) {
+      extensionHits.push({ relativePath, decoder });
+    }
+  }
+  if (unread.files || unread.extensions) {
+    const detail = `The Brotli decoder probe left ${unread.files} executable(s) or librar(ies) and ${unread.extensions} extension module(s) unread after reaching its file or byte cap, so an embedded decoder in them is not reported.`;
+    thoughtLog(detail);
+    recordDegradation("binary.brotli-probe.capped", {
+      ecosystem: "generic",
+      tool: "brotli-probe",
+      impact: "components",
+      path: basePath,
+      detail,
+    });
+  }
+  const extensionFiles = [];
+  if (extensionHits.length) {
+    const components = await fileComponents(
+      basePath,
+      extensionHits.map((hit) => hit.relativePath),
+      "shared_library",
+    );
+    for (let index = 0; index < components.length; index++) {
+      const component = components[index];
+      // Extension modules often share a basename (brotli.so is both a PHP and
+      // a Ruby extension), so the path keeps each one a component of its own.
+      const purl = tryBuildPurl({
+        type: "generic",
+        name: component.name,
+        subpath: extensionHits[index].relativePath,
+      });
+      if (purl) {
+        component.purl = purl;
+        component["bom-ref"] = purl;
+      }
+      attachBrotliDecoder(inventory, component, extensionHits[index].decoder);
+      extensionFiles.push(component);
+    }
+  }
+  return { ...finishBrotliInventory(inventory), extensionFiles };
+}
+
 async function fileComponents(basePath, fileList, fileType) {
   const hashResults = await mapWithConcurrency(fileList, (f) =>
     multiChecksumFile(["md5", "sha1"], join(basePath, f))

package/lib/managers/docker.js

@@ -10,6 +10,7 @@ import {
   basename,
   isAbsolute,
   join,
+  posix,
   relative,
   resolve,
   win32,
@@ -2487,6 +2488,77 @@ export const exportImage = async (fullImageName, options) => {
   return undefined;
 };
 
+// Directories that hold far more than gems. An image that names one as its gem
+// directory would turn the gem scan into a scan of the whole tree.
+const BROAD_IMAGE_DIRS = new Set([
+  "/bin",
+  "/boot",
+  "/dev",
+  "/etc",
+  "/home",
+  "/lib",
+  "/lib64",
+  "/opt",
+  "/proc",
+  "/root",
+  "/run",
+  "/sbin",
+  "/srv",
+  "/sys",
+  "/tmp",
+  "/usr",
+  "/usr/bin",
+  "/usr/lib",
+  "/usr/lib64",
+  "/usr/local",
+  "/usr/local/lib",
+  "/usr/share",
+  "/var",
+  "/var/lib",
+]);
+const MAX_IMAGE_GEM_DIRS = 16;
+
+/**
+ * The gem directories an image's environment names in GEM_HOME, GEM_PATH and
+ * BUNDLE_PATH. Only absolute paths without `..` segments are kept, so an image
+ * cannot steer the scan outside its own root, and each is normalized; the root
+ * and broad system directories such as /usr or /var are refused, so an image
+ * cannot turn the gem scan into a scan of the whole tree.
+ *
+ * @param {string[]|undefined} env image config Env entries, `NAME=value`
+ * @returns {string[]} absolute in-image directories, deduplicated, at most
+ *   MAX_IMAGE_GEM_DIRS
+ */
+export function imageGemDirs(env) {
+  const dirs = new Set();
+  if (!Array.isArray(env)) {
+    return [];
+  }
+  for (const entry of env) {
+    if (typeof entry !== "string") {
+      continue;
+    }
+    const separator = entry.indexOf("=");
+    if (separator <= 0) {
+      continue;
+    }
+    const name = entry.slice(0, separator);
+    if (!["GEM_HOME", "GEM_PATH", "BUNDLE_PATH"].includes(name)) {
+      continue;
+    }
+    for (const value of entry.slice(separator + 1).split(":")) {
+      if (!value.startsWith("/") || value.split("/").includes("..")) {
+        continue;
+      }
+      const dir = posix.normalize(value).replace(/\/+$/, "");
+      if (dir && !BROAD_IMAGE_DIRS.has(dir)) {
+        dirs.add(dir);
+      }
+    }
+  }
+  return Array.from(dirs).sort().slice(0, MAX_IMAGE_GEM_DIRS);
+}
+
 /**
  * Method to retrieve path list for system-level packages
  */
@@ -2530,6 +2602,7 @@ export const getPkgPathList = (exportData, lastWorkingDir) => {
   if (allLayersExplodedDir && allLayersExplodedDir !== "") {
     knownSysPaths = knownSysPaths.concat([
       join(allLayersExplodedDir, "/usr/local/go"),
+      join(allLayersExplodedDir, "/usr/local/bundle"),
       join(allLayersExplodedDir, "/usr/local/lib"),
       join(allLayersExplodedDir, "/usr/local/lib64"),
       join(allLayersExplodedDir, "/opt"),
@@ -2544,6 +2617,7 @@ export const getPkgPathList = (exportData, lastWorkingDir) => {
   } else if (allLayersExplodedDir === "") {
     knownSysPaths = knownSysPaths.concat([
       join(allLayersExplodedDir, "/usr/local/go"),
+      join(allLayersExplodedDir, "/usr/local/bundle"),
       join(allLayersExplodedDir, "/usr/local/lib"),
       join(allLayersExplodedDir, "/usr/local/lib64"),
       join(allLayersExplodedDir, "/opt"),
@@ -2554,6 +2628,11 @@ export const getPkgPathList = (exportData, lastWorkingDir) => {
       join(allLayersExplodedDir, "/var/lib"),
     ]);
   }
+  // The official Ruby images install gems into GEM_HOME=/usr/local/bundle, and
+  // an image can point GEM_HOME, GEM_PATH or BUNDLE_PATH anywhere else.
+  for (const gemDir of imageGemDirs(exportData?.inspectData?.Config?.Env)) {
+    knownSysPaths.push(join(allLayersExplodedDir || "", gemDir));
+  }
   if (safeExistsSync(join(allLayersDir, "Files"))) {
     knownSysPaths.push(join(allLayersDir, "Files"));
   }