From 12f0e2d83722544b45507c983590c479fc7bec52 Mon Sep 17 00:00:00 2001 From: Pujitha Paladugu Date: Wed, 28 Oct 2026 08:01:40 -0700 Subject: [PATCH] fix(binary): detect envoy 1.37.1 and 1.40.x binaries (#5476) Motivation: the envoy binary classifier returns no package for envoy 1.37.1, 1.40.0 and 1.40.1 (the official envoyproxy/envoy images), while neighbouring versions such as 1.37.0 and 1.38.0 are detected. Approach: - the main matcher (NUL-delimited version followed by envoy_reloadable_features) only accepted 1.3x; widen it to 1.[34]x, which covers 1.40.0 and 1.40.1. - in the 1.37.1 binary the version string sits between different neighbouring strings, so the existing matchers do not fire. Add a matcher anchored on the preceding "DeltaDiscoveryResponse.removed_resources" string. - add snippets, config.yaml entries and test cases for 1.37.1, 1.40.0, 1.40.1 (linux/amd64 images, pinned by digest). Validation: - cd syft/pkg/cataloger/binary && go test . -run 'Test_Cataloger_PositiveCases/envoy' : the three new fixtures fail without the classifiers.go change and all envoy cases pass with it. - golangci-lint run ./syft/pkg/cataloger/binary/... : 0 issues. - Built syft before/after and scanned the full linux/arm64 envoy binaries from the official images: 1.37.1, 1.40.0 and 1.40.1 were not reported before and are reported with the right version after; 1.37.0 and 1.38.0 are unchanged. - Not run: the rest of the package test suite needs docker, which is not available here (Test_PEPackageCataloger etc.), and snippets for other binaries are not downloaded locally. The contrib-build fallback matchers still only accept 1.3x; they are untouched. Report: https://github.com/anchore/syft/issues/5470 Assisted-by: claude-sonnet-5-5 (via Claude Code) Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --- .../binary/classifier_cataloger_test.go | 33 ++++++++++++++++++ syft/pkg/cataloger/binary/classifiers.go | 5 ++- .../snippets/envoy/1.37.1/linux-amd64/envoy | Bin 0 -> 429 bytes .../snippets/envoy/1.40.0/linux-amd64/envoy | Bin 0 -> 630 bytes .../snippets/envoy/1.40.1/linux-amd64/envoy | Bin 0 -> 629 bytes .../pkg/cataloger/binary/testdata/config.yaml | 21 +++++++++++ 6 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/snippets/envoy/1.37.1/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/snippets/envoy/1.40.0/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/snippets/envoy/1.40.1/linux-amd64/envoy diff --git a/syft/pkg/cataloger/binary/classifier_cataloger_test.go b/syft/pkg/cataloger/binary/classifier_cataloger_test.go index a45bcbb0b..4138d7e76 100644 --- a/syft/pkg/cataloger/binary/classifier_cataloger_test.go +++ b/syft/pkg/cataloger/binary/classifier_cataloger_test.go @@ -2629,6 +2629,39 @@ func Test_Cataloger_PositiveCases(t *testing.T) { Metadata: metadata("grafana-binary"), }, }, + { + logicalFixture: "envoy/1.40.1/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.40.1", + Type: "binary", + PURL: "pkg:generic/envoy@1.40.1", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.40.0/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.40.0", + Type: "binary", + PURL: "pkg:generic/envoy@1.40.0", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.37.1/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.37.1", + Type: "binary", + PURL: "pkg:generic/envoy@1.37.1", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, { logicalFixture: "envoy/1.36.4/linux-amd64", expected: pkg.Package{ diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go index 2f9037a94..df648d653 100644 --- a/syft/pkg/cataloger/binary/classifiers.go +++ b/syft/pkg/cataloger/binary/classifiers.go @@ -1135,9 +1135,12 @@ func DefaultClassifiers() []binutils.Classifier { FileGlob: "**/envoy", EvidenceMatcher: binutils.MatchAny( // 1.3x [NUL]1.36.4[NUL]...envoy_reloadable_features + // 1.4x [NUL]1.40.1[NUL]...envoy_reloadable_features // 1.34.5 [NUL]1.34.5[NUL]...envoy.reloadable_features - m.FileContentsVersionMatcher(`(?s)\x00(?P1\.3[0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`), + m.FileContentsVersionMatcher(`(?s)\x00(?P1\.[34][0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`), m.FileContentsVersionMatcher(`(?s)\x00(?P1\.34\.5)\x00.{0,200}envoy\.reloadable_features`), + // 1.37.1 DeltaDiscoveryResponse.removed_resources[NUL]1.37.1[NUL]the default now- + m.FileContentsVersionMatcher(`(?s)DeltaDiscoveryResponse\.removed_resources\x00(?P1\.[34][0-9]\.[0-9]+(-dev)?)\x00`), // 1.2x envoy_quic_...[NUL]1.28.7[NUL] m.FileContentsVersionMatcher(`(?s)envoy_quic_.{0,1000}\x00(?P1\.2[0-9]\.[0-9]+(-dev)?)\x00`), // 1.2x [NUL]1.20.7[NUL]Unable to diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/envoy/1.37.1/linux-amd64/envoy b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/envoy/1.37.1/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..125d90ea8c57697379a764c54b3372cb46cb0e60 GIT binary patch literal 429 zcmX|+K~DoA5QX==zk;Ok=!Ruk7WUjVy=aYEJvJ1E7DHhJbWQ#BqER!4m&|-`-i()L z7!mj-TK9dNv|$aEIBzIM*P!620bBc0>uL zi(ozoOc_;N3qq*Yk_^lUE;``QE0C-<*1_L0t`7nOU@0;0B``j8`d~;~inmM?VVI(Q zuj#Uy-<|IoC~7&5mLBB1*vMAZfM#np8#nv^5Qb`;p4X2 z%_&Ea=UvH}-a+L%Y278lBNUs@@(9yXwAy9s?5E5&_-cBc9$xm(o9)~FetOw#*VRoL MQG~)p=`*ta3us1)g#Z8m literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/envoy/1.40.0/linux-amd64/envoy b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/envoy/1.40.0/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..aab0400b3c4b98c244044a32f9d2aecdfa9f233e GIT binary patch literal 630 zcmaJ-yKdYt5LB(NAaHdAih8Rv(%OxU6sd?6xx8aQkutf`SqSp)p%bSI+_0G8>^wZI zI5YG|ILly6LYi64n_(K-p>*i4bembrd6~T3Hl&vuh_0U*Z!`+Ns7@;c(F$mKt?F(> zVT=)c8b;uPk4?LD&<@abpvRtzeuN2;PpUN5;lE=eK-~;5XwIjpRoFJBubZyxO$W8$ z1D}MLOy4Z1m$66G8at&H)pDW4GV-##TrO-m3E4+XMuC~&T)4ALmHPCsS|vA#xi4W% z#h=Pm!gyGPm9|NR1LIj8P4$c^>@lNRghgGoyy68*fdTWuf6-`Qcf<~GJF<08l;JyD zkm1|rtg_@zmWM39`3#^U)a?7i(_^L;Ze)X>+0S3aSC^F-AF?Z4@nu&EQ+fu%BH1gb z_kVvw%7`w2hQ*;Y2((8`(%IFL{E>oxFO_RZkBO|mN}WA!pD4E&-cFfc3M#mKe9grr tg&QwkW5n2 zX(kn;jOoer{m{!iTxOfjl$9Uz?BvnBZJ^KzXWF*tXz5M_ll=QL1{2 z+q_+Q$!I;M>MN#jM1?u{8Nk}RG+zhU#fgRdQA#Z*2NFV+Qr*u3(TMMi$?WrFVjRumc|-%5(h wA3vfiov5IZ|2i<9d>2t{={-Wud--)F