oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 16:48:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(debian): supplement point release from /etc/debian_version (#4997)

Browse Source 
Debian's /etc/os-release declares only the major version in VERSION_ID (e.g. "13"), while /etc/debian_version carries the point release (e.g. "13.5"). The cataloger previously skipped debian_version whenever os-release already had a Version/VersionID, so point releases were lost.

Signed-off-by: Osama Elhindawy <25825931+OsamaSE@users.noreply.github.com>
This commit is contained in:
OsamaSE 2026-07-06 19:18:37 +04:00 committed by GitHub
parent ebac92a86e
commit 3e399256b3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 31 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
syft/linux/identify_release_test.go
View File

@ -101,6 +101,22 @@ func TestIdentifyRelease(t *testing.T) {
BugReportURL: "https://github.com/GoogleContainerTools/distroless/issues/new",
},
},
{
// standard Debian: VERSION_ID has major only, debian_version has the point release
fixture: "testdata/os/debian/with-point-release",
release: &Release{
PrettyName: "Debian GNU/Linux 13 (trixie)",
Name: "Debian GNU/Linux",
ID: "debian",
IDLike: nil,
Version: "13 (trixie)",
VersionID: "13.5",
VersionCodename: "trixie",
HomeURL: "https://www.debian.org/",
SupportURL: "https://www.debian.org/support",
BugReportURL: "https://bugs.debian.org/",
},
},
{
fixture: "testdata/os/fedora",
release: &Release{

9
syft/linux/supplement_release.go
View File

@ -11,11 +11,10 @@ import (
)
func supplementDebianVersion(resolver file.Resolver, release *Release) {
// we're only looking for version information for debian when none is present in /etc/os-release
if release.Version != "" || release.VersionID != "" || !strings.EqualFold(release.ID, "debian") {
if !strings.EqualFold(release.ID, "debian") {
return
}
// if we have a debian release with no version, look for a debian_version
// debian_version has a more specific point release than os-release
locations, err := resolver.FilesByGlob("/etc/debian_version")
if err != nil {
log.Debugf("error reading /etc/debian_version: %v", err)
@ -24,8 +23,10 @@ func supplementDebianVersion(resolver file.Resolver, release *Release) {
for _, location := range locations {
version := readDebianVersionFile(resolver, location)
if version != "" {
release.Version = version
release.VersionID = version
if release.Version == "" {
release.Version = version
}
return // keep the first result
}
}

1
syft/linux/testdata/os/debian/with-point-release/etc/debian_version vendored Normal file
View File

@ -0,0 +1 @@
13.5

9
syft/linux/testdata/os/debian/with-point-release/etc/os-release vendored Normal file
View File

@ -0,0 +1,9 @@
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"