From 236ab25393c9bb826fabb9aa7a6ca554088d7b3b Mon Sep 17 00:00:00 2001 From: Alex Goodman Date: Tue, 29 Sep 2026 11:19:17 -0400 Subject: [PATCH] test(snap): bound the kernel changelog bomb fixture by ratio, not a fixed 1MB (#5352) Same issue as #5350: go1.27's compress/flate encodes this 512MB fixture to just over 1MB, so the fixture sanity check tripped before the bound was exercised. The line bound itself is fine. Signed-off-by: Alex Goodman --- syft/pkg/cataloger/snap/parse_kernel_changelog_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/syft/pkg/cataloger/snap/parse_kernel_changelog_test.go b/syft/pkg/cataloger/snap/parse_kernel_changelog_test.go index 063161d19..a1806a822 100644 --- a/syft/pkg/cataloger/snap/parse_kernel_changelog_test.go +++ b/syft/pkg/cataloger/snap/parse_kernel_changelog_test.go @@ -330,7 +330,9 @@ func TestParseKernelChangelog_gzipBombStaysBounded(t *testing.T) { remaining -= n } require.NoError(t, gw.Close()) - require.Less(t, gz.Len(), 1024*1024, "compressed payload should be tiny relative to what it expands to") + // compress/flate output for this input varies by Go version (about 510KB on go1.26, 1MB on go1.27), so + // bound the fixture by ratio rather than a fixed size + require.Less(t, gz.Len(), expanded/100, "compressed payload should be tiny relative to what it expands to") // prove the fixture is a bomb: the same stream read without a line bound costs its full size unbounded := testutils.MeasureAlloc(t, func() {