oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 16:48:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix panic on cabal.project.freeze 'installed' boot-lib constraints (#5040)

Browse Source 
GHC boot-lib constraints (any.base installed) have no ' ==', so fields[1] panicked with index out of range and the recover dropped all Haskell packages. Skip constraint lines without a version.

Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com>
Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>
This commit is contained in:
Synvoya 2026-07-14 00:57:32 +10:00 committed by GitHub
parent 7745e450fa
commit 3cc3ecb003
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
syft/pkg/cataloger/haskell/parse_cabal_freeze.go
View File

@ -45,6 +45,10 @@ func parseCabalFreeze(_ context.Context, _ file.Resolver, _ *generic.Environment
line = line[startPkgEncoding:endPkgEncoding] line = line[startPkgEncoding:endPkgEncoding]
fields := strings.Split(line, " ==") fields := strings.Split(line, " ==")
// skip constraints without a version (e.g. GHC boot libs: "any.base installed")
if len(fields) < 2 {
continue
}
pkgName, pkgVersion := fields[0], fields[1] pkgName, pkgVersion := fields[0], fields[1]
pkgs = append( pkgs = append(

2
syft/pkg/cataloger/haskell/testdata/cabal.project.freeze vendored
View File

@ -1,5 +1,7 @@
active-repositories: hackage.haskell.org:merge active-repositories: hackage.haskell.org:merge
constraints: any.Cabal ==3.2.1.0, constraints: any.Cabal ==3.2.1.0,
any.array installed,
any.base installed,
any.Diff ==0.4.1, any.Diff ==0.4.1,
any.HTTP ==4000.3.16, any.HTTP ==4000.3.16,
any.HUnit ==1.6.2.0, any.HUnit ==1.6.2.0,