From 3e399256b3dc36b699d5e9cec33928f7e3c12c5e Mon Sep 17 00:00:00 2001
From: OsamaSE <25825931+OsamaSE@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:18:37 +0400
Subject: [PATCH] fix(debian): supplement point release from
 /etc/debian_version (#4997)

Debian's /etc/os-release declares only the major version in VERSION_ID (e.g. "13"), while /etc/debian_version carries the point release (e.g. "13.5"). The cataloger previously skipped debian_version whenever os-release already had a Version/VersionID, so point releases were lost.

Signed-off-by: Osama Elhindawy <25825931+OsamaSE@users.noreply.github.com>
---
 syft/linux/identify_release_test.go              | 16 ++++++++++++++++
 syft/linux/supplement_release.go                 |  9 +++++----
 .../debian/with-point-release/etc/debian_version |  1 +
 .../os/debian/with-point-release/etc/os-release  |  9 +++++++++
 4 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 syft/linux/testdata/os/debian/with-point-release/etc/debian_version
 create mode 100644 syft/linux/testdata/os/debian/with-point-release/etc/os-release

diff --git a/syft/linux/identify_release_test.go b/syft/linux/identify_release_test.go
index d1f67f957..1c719351d 100644
--- a/syft/linux/identify_release_test.go
+++ b/syft/linux/identify_release_test.go
@@ -101,6 +101,22 @@ func TestIdentifyRelease(t *testing.T) {
 				BugReportURL: "https://github.com/GoogleContainerTools/distroless/issues/new",
 			},
 		},
+		{
+			// standard Debian: VERSION_ID has major only, debian_version has the point release
+			fixture: "testdata/os/debian/with-point-release",
+			release: &Release{
+				PrettyName:      "Debian GNU/Linux 13 (trixie)",
+				Name:            "Debian GNU/Linux",
+				ID:              "debian",
+				IDLike:          nil,
+				Version:         "13 (trixie)",
+				VersionID:       "13.5",
+				VersionCodename: "trixie",
+				HomeURL:         "https://www.debian.org/",
+				SupportURL:      "https://www.debian.org/support",
+				BugReportURL:    "https://bugs.debian.org/",
+			},
+		},
 		{
 			fixture: "testdata/os/fedora",
 			release: &Release{
diff --git a/syft/linux/supplement_release.go b/syft/linux/supplement_release.go
index dfa2c9b28..33a6815f6 100644
--- a/syft/linux/supplement_release.go
+++ b/syft/linux/supplement_release.go
@@ -11,11 +11,10 @@ import (
 )
 
 func supplementDebianVersion(resolver file.Resolver, release *Release) {
-	// we're only looking for version information for debian when none is present in /etc/os-release
-	if release.Version != "" || release.VersionID != "" || !strings.EqualFold(release.ID, "debian") {
+	if !strings.EqualFold(release.ID, "debian") {
 		return
 	}
-	// if we have a debian release with no version, look for a debian_version
+	// debian_version has a more specific point release than os-release
 	locations, err := resolver.FilesByGlob("/etc/debian_version")
 	if err != nil {
 		log.Debugf("error reading /etc/debian_version: %v", err)
@@ -24,8 +23,10 @@ func supplementDebianVersion(resolver file.Resolver, release *Release) {
 	for _, location := range locations {
 		version := readDebianVersionFile(resolver, location)
 		if version != "" {
-			release.Version = version
 			release.VersionID = version
+			if release.Version == "" {
+				release.Version = version
+			}
 			return // keep the first result
 		}
 	}
diff --git a/syft/linux/testdata/os/debian/with-point-release/etc/debian_version b/syft/linux/testdata/os/debian/with-point-release/etc/debian_version
new file mode 100644
index 000000000..e09420105
--- /dev/null
+++ b/syft/linux/testdata/os/debian/with-point-release/etc/debian_version
@@ -0,0 +1 @@
+13.5
diff --git a/syft/linux/testdata/os/debian/with-point-release/etc/os-release b/syft/linux/testdata/os/debian/with-point-release/etc/os-release
new file mode 100644
index 000000000..e99969d90
--- /dev/null
+++ b/syft/linux/testdata/os/debian/with-point-release/etc/os-release
@@ -0,0 +1,9 @@
+PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
+NAME="Debian GNU/Linux"
+VERSION_ID="13"
+VERSION="13 (trixie)"
+VERSION_CODENAME=trixie
+ID=debian
+HOME_URL="https://www.debian.org/"
+SUPPORT_URL="https://www.debian.org/support"
+BUG_REPORT_URL="https://bugs.debian.org/"