From 3cc3ecb003079b5a909ac1ff0e4c30d256997059 Mon Sep 17 00:00:00 2001 From: Synvoya Date: Tue, 14 Jul 2026 00:57:32 +1000 Subject: [PATCH] Fix panic on cabal.project.freeze 'installed' boot-lib constraints (#5040) GHC boot-lib constraints (any.base installed) have no ' ==', so fields[1] panicked with index out of range and the recover dropped all Haskell packages. Skip constraint lines without a version. Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com> Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com> --- syft/pkg/cataloger/haskell/parse_cabal_freeze.go | 4 ++++ syft/pkg/cataloger/haskell/testdata/cabal.project.freeze | 2 ++ 2 files changed, 6 insertions(+) diff --git a/syft/pkg/cataloger/haskell/parse_cabal_freeze.go b/syft/pkg/cataloger/haskell/parse_cabal_freeze.go index 614524cae..b7f11093e 100644 --- a/syft/pkg/cataloger/haskell/parse_cabal_freeze.go +++ b/syft/pkg/cataloger/haskell/parse_cabal_freeze.go @@ -45,6 +45,10 @@ func parseCabalFreeze(_ context.Context, _ file.Resolver, _ *generic.Environment line = line[startPkgEncoding:endPkgEncoding] fields := strings.Split(line, " ==") + // skip constraints without a version (e.g. GHC boot libs: "any.base installed") + if len(fields) < 2 { + continue + } pkgName, pkgVersion := fields[0], fields[1] pkgs = append( diff --git a/syft/pkg/cataloger/haskell/testdata/cabal.project.freeze b/syft/pkg/cataloger/haskell/testdata/cabal.project.freeze index f20ce8cb5..6843f5d47 100644 --- a/syft/pkg/cataloger/haskell/testdata/cabal.project.freeze +++ b/syft/pkg/cataloger/haskell/testdata/cabal.project.freeze @@ -1,5 +1,7 @@ active-repositories: hackage.haskell.org:merge constraints: any.Cabal ==3.2.1.0, + any.array installed, + any.base installed, any.Diff ==0.4.1, any.HTTP ==4000.3.16, any.HUnit ==1.6.2.0,