diff --git a/syft/pkg/catalog.go b/syft/pkg/catalog.go index 6325ae1cf..40af8c851 100644 --- a/syft/pkg/catalog.go +++ b/syft/pkg/catalog.go @@ -7,12 +7,6 @@ import ( "github.com/anchore/syft/internal/log" ) -var globsForbiddenFromBeingOwned = []string{ - ApkDbGlob, - DpkgDbGlob, - RpmDbGlob, -} - // Catalog represents a collection of Packages. type Catalog struct { byID map[ID]*Package diff --git a/syft/pkg/ownership_by_files_relationship.go b/syft/pkg/ownership_by_files_relationship.go index 23213604d..0151ee2b4 100644 --- a/syft/pkg/ownership_by_files_relationship.go +++ b/syft/pkg/ownership_by_files_relationship.go @@ -6,6 +6,16 @@ import ( "github.com/scylladb/go-set/strset" ) +var globsForbiddenFromBeingOwned = []string{ + // any OS DBs should automatically be ignored to prevent cyclic issues (e.g. the "rpm" RPM owns the path to the + // RPM DB, so if not ignored that package would own all other packages on the system). + ApkDbGlob, + DpkgDbGlob, + RpmDbGlob, + // DEB packages share common copyright info between, this does not mean that sharing these paths implies ownership. + "/usr/share/doc/**/copyright", +} + type ownershipByFilesMetadata struct { Files []string `json:"files"` }