fix:best effort to get the os info of an ELF binary (#4438)

* fix:the os of an elf binary should be detected even when the os version is empty Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:revoke the update of appCpe Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:resume the testcase Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * fix:revoke the possible compromise to the json schema Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * fix:align with the json schema Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * add a json schema(pre-relase,may be in conflict with others') Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:add a json schema Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:revert the accidental change to 16.1.0 Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * regression/fix:best effort to get the os info Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:resume the previous json file Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * update the schema ver to 16.2.0 Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore:no breaking behavior Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * chore: follow the guide of the README.md Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * appCpe is temporarily unused Signed-off-by: Yuntao Hu <victorhu493@gmail.com> * preserve json field for osCPE Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Yuntao Hu <victorhu493@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-11-01 23:16:30 +01:00 · 2025-12-12 19:13:59 +00:00
parent 6be0a9abc4
commit 4c38ee1932
12 changed files with 4404 additions and 20 deletions
@@ -68,11 +68,15 @@ func osNameAndVersionFromMetadata(metadata elfBinaryPackageNotes) (string, strin
 		return os, osVersion
 	}

-	if metadata.OSCPE == "" {
+	if metadata.OSCPE == "" { //nolint:staticcheck
+		// best-effort to get the os info
+		if os != "" {
+			return os, ""
+		}
 		return "", ""
 	}

-	attrs, err := cpe.NewAttributes(metadata.OSCPE)
+	attrs, err := cpe.NewAttributes(metadata.OSCPE) //nolint:staticcheck
 	if err != nil {
 		log.WithFields("error", err).Trace("unable to parse cpe attributes for elf binary package")
 		return "", ""
@@ -34,7 +34,10 @@ type elfBinaryPackageNotes struct {
 	CPE                                 string `json:"cpe"`
 	License                             string `json:"license"`
 	pkg.ELFBinaryPackageNoteJSONPayload `json:",inline"`
-	Location                            file.Location `json:"-"`
+	// CorrectOSCPE has the corrected casing for the osCPE field relative to the systemd ELF package metadata "spec" https://systemd.io/ELF_PACKAGE_METADATA/ .
+	// Ideally in syft 2.0 this field should be replaced with the pkg.ELFBinaryPackageNoteJSONPayload.OSCPE field directly (with the struct tag corrected).
+	CorrectOSCPE string        `json:"osCpe,omitempty"`
+	Location     file.Location `json:"-"`
 }

 type elfPackageKey struct {
@@ -164,9 +167,9 @@ func getELFNotes(r file.LocationReadCloser) (*elfBinaryPackageNotes, error) {
 	}

 	{
-		var metadata elfBinaryPackageNotes
-		if err := json.Unmarshal(notes, &metadata); err == nil {
-			return &metadata, nil
+		var metadata *elfBinaryPackageNotes
+		if metadata, err = unmarshalELFPackageNotesPayload(notes); err == nil {
+			return metadata, nil
 		}
 	}

@@ -174,10 +177,10 @@ func getELFNotes(r file.LocationReadCloser) (*elfBinaryPackageNotes, error) {
 		var header elf64SectionHeader
 		headerSize := binary.Size(header) / 4
 		if len(notes) > headerSize {
-			var metadata elfBinaryPackageNotes
+			var metadata *elfBinaryPackageNotes
 			newPayload := bytes.TrimRight(notes[headerSize:], "\x00")
-			if err = json.Unmarshal(newPayload, &metadata); err == nil {
-				return &metadata, nil
+			if metadata, err = unmarshalELFPackageNotesPayload(newPayload); err == nil {
+				return metadata, nil
 			}
 			log.WithFields("file", r.Location.Path(), "error", err).Trace("unable to unmarshal ELF package notes as JSON")
 		}
@@ -186,6 +189,21 @@ func getELFNotes(r file.LocationReadCloser) (*elfBinaryPackageNotes, error) {
 	return nil, err
 }

+func unmarshalELFPackageNotesPayload(data []byte) (*elfBinaryPackageNotes, error) {
+	var metadata elfBinaryPackageNotes
+	if err := json.Unmarshal(data, &metadata); err != nil {
+		return nil, fmt.Errorf("unable to unmarshal ELF package notes payload: %w", err)
+	}
+
+	// normalize the os CPE field
+	if metadata.OSCPE == "" { //nolint:staticcheck
+		// ensure the public field is populated for backwards compatibility
+		metadata.OSCPE = metadata.CorrectOSCPE //nolint:staticcheck
+	}
+
+	return &metadata, nil
+}
+
 type elf64SectionHeader struct {
 	ShName      uint32
 	ShType      uint32
@@ -5,6 +5,7 @@ import (

 	"github.com/stretchr/testify/require"

+	extFile "github.com/anchore/stereoscope/pkg/file"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest"
@@ -112,6 +113,29 @@ func Test_ELFPackageCataloger(t *testing.T) {
 				},
 			},
 		},
+		{
+			name:    "Debian 64 bit binaries w/o os version",
+			fixture: "image-wolfi-64bit-without-version",
+			expected: []pkg.Package{
+				{
+					Name:    "glibc",
+					Version: "2.42-r4",
+					PURL:    "pkg:apk/wolfi/glibc@2.42-r4?distro=wolfi",
+					Locations: file.NewLocationSet(
+						file.NewLocationFromDirectory("/lib/libBrokenLocale.so.1",
+							"sha256:559eaef4e501b8e7a150661a94ee8b9ebc63bfca3256953a703f9f82053346f2",
+							*extFile.NewFileReference("/lib/libBrokenLocale.so.1")).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
+					),
+					Licenses: pkg.NewLicenseSet(),
+					Type:     pkg.ApkPkg,
+					Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
+						Type:         "apk",
+						Architecture: "x86_64",
+						OS:           "wolfi",
+					},
+				},
+			},
+		},
 	}

 	for _, v := range cases {
@@ -126,3 +150,61 @@ func Test_ELFPackageCataloger(t *testing.T) {
 	}

 }
+
+func Test_unmarshalELFPackageNotesPayload(t *testing.T) {
+	tests := []struct {
+		name        string
+		payload     string
+		wantOSCPE   string
+		wantCorrect string
+		wantErr     require.ErrorAssertionFunc
+	}{
+		{
+			name:        "only osCPE (incorrect) provided",
+			payload:     `{"name":"test","version":"1.0","osCPE":"cpe:/o:fedoraproject:fedora:40"}`,
+			wantOSCPE:   "cpe:/o:fedoraproject:fedora:40",
+			wantCorrect: "",
+		},
+		{
+			name:        "only osCpe (correct) provided",
+			payload:     `{"name":"test","version":"1.0","osCpe":"cpe:/o:fedoraproject:fedora:40"}`,
+			wantOSCPE:   "cpe:/o:fedoraproject:fedora:40",
+			wantCorrect: "cpe:/o:fedoraproject:fedora:40",
+		},
+		{
+			name:        "both osCPE and osCpe provided uses osCPE",
+			payload:     `{"name":"test","version":"1.0","osCPE":"cpe:/o:fedoraproject:fedora:40","osCpe":"cpe:/o:redhat:rhel:9"}`,
+			wantOSCPE:   "cpe:/o:fedoraproject:fedora:40",
+			wantCorrect: "cpe:/o:redhat:rhel:9",
+		},
+		{
+			name:        "neither osCPE nor osCpe provided",
+			payload:     `{"name":"test","version":"1.0"}`,
+			wantOSCPE:   "",
+			wantCorrect: "",
+		},
+		{
+			name:    "invalid JSON",
+			payload: `{invalid}`,
+			wantErr: require.Error,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.wantErr == nil {
+				tt.wantErr = require.NoError
+			}
+
+			got, err := unmarshalELFPackageNotesPayload([]byte(tt.payload))
+			tt.wantErr(t, err)
+
+			if err != nil {
+				return
+			}
+
+			require.Equal(t, tt.wantOSCPE, got.OSCPE)
+			require.Equal(t, tt.wantCorrect, got.CorrectOSCPE)
+		})
+	}
+}
@@ -0,0 +1,7 @@
+FROM --platform=linux/amd64 cgr.dev/chainguard/wolfi-base AS build
+
+FROM scratch
+COPY --from=build /lib/libBrokenLocale.so.1 /lib/libBrokenLocale.so.1
+
+CMD ["/bin/sh"]
+