From 81dd9558714639a848d6a843988106c6ddb5d943 Mon Sep 17 00:00:00 2001 From: witchcraze <67056980+witchcraze@users.noreply.github.com> Date: Tue, 6 Jan 2026 22:45:01 +0900 Subject: [PATCH] add envoy binary classifier (#4530) * add envoy classifier Signed-off-by: witchcraze * add envoy classifier Signed-off-by: witchcraze --- syft/pkg/cataloger/binary/capabilities.yaml | 10 ++ .../binary/classifier_cataloger_test.go | 99 ++++++++++++++++++ syft/pkg/cataloger/binary/classifiers.go | 26 +++++ .../snippets/envoy/1.11.0/linux-amd64/envoy | Bin 0 -> 428 bytes .../snippets/envoy/1.14.3/linux-amd64/envoy | Bin 0 -> 849 bytes .../snippets/envoy/1.18.6/linux-amd64/envoy | Bin 0 -> 349 bytes .../snippets/envoy/1.20.7/linux-amd64/envoy | Bin 0 -> 349 bytes .../snippets/envoy/1.22.11/linux-amd64/envoy | Bin 0 -> 549 bytes .../snippets/envoy/1.28.7/linux-amd64/envoy | Bin 0 -> 829 bytes .../snippets/envoy/1.34.5/linux-amd64/envoy | Bin 0 -> 459 bytes .../snippets/envoy/1.36.4/linux-amd64/envoy | Bin 0 -> 749 bytes .../snippets/envoy/1.6.0/linux-amd64/envoy | Bin 0 -> 349 bytes .../binary/test-fixtures/config.yaml | 63 +++++++++++ 13 files changed, 198 insertions(+) create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.11.0/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.14.3/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.18.6/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.20.7/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.22.11/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.28.7/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.34.5/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.36.4/linux-amd64/envoy create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.6.0/linux-amd64/envoy diff --git a/syft/pkg/cataloger/binary/capabilities.yaml b/syft/pkg/cataloger/binary/capabilities.yaml index a0ed0c35d..e4c7d6534 100644 --- a/syft/pkg/cataloger/binary/capabilities.yaml +++ b/syft/pkg/cataloger/binary/capabilities.yaml @@ -623,6 +623,16 @@ catalogers: cpes: - cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* type: BinaryPkg + - method: glob + criteria: + - '**/envoy' + packages: + - class: envoy-binary + name: envoy + purl: pkg:generic/envoy + cpes: + - cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* + type: BinaryPkg - method: glob criteria: - '**/java' diff --git a/syft/pkg/cataloger/binary/classifier_cataloger_test.go b/syft/pkg/cataloger/binary/classifier_cataloger_test.go index 4f839da2d..4d21c5b9c 100644 --- a/syft/pkg/cataloger/binary/classifier_cataloger_test.go +++ b/syft/pkg/cataloger/binary/classifier_cataloger_test.go @@ -1529,6 +1529,105 @@ func Test_Cataloger_PositiveCases(t *testing.T) { Metadata: metadata("grafana-binary"), }, }, + { + logicalFixture: "envoy/1.36.4/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.36.4", + Type: "binary", + PURL: "pkg:generic/envoy@1.36.4", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.34.5/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.34.5", + Type: "binary", + PURL: "pkg:generic/envoy@1.34.5", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.28.7/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.28.7", + Type: "binary", + PURL: "pkg:generic/envoy@1.28.7", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.22.11/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.22.11", + Type: "binary", + PURL: "pkg:generic/envoy@1.22.11", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.20.7/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.20.7", + Type: "binary", + PURL: "pkg:generic/envoy@1.20.7", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.18.6/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.18.6-dev", + Type: "binary", + PURL: "pkg:generic/envoy@1.18.6-dev", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.14.3/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.14.3", + Type: "binary", + PURL: "pkg:generic/envoy@1.14.3", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.11.0/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.11.0", + Type: "binary", + PURL: "pkg:generic/envoy@1.11.0", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, + { + logicalFixture: "envoy/1.6.0/linux-amd64", + expected: pkg.Package{ + Name: "envoy", + Version: "1.6.0", + Type: "binary", + PURL: "pkg:generic/envoy@1.6.0", + Locations: locations("envoy"), + Metadata: metadata("envoy-binary"), + }, + }, } for _, test := range tests { diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go index 99a8aafc1..025f546f1 100644 --- a/syft/pkg/cataloger/binary/classifiers.go +++ b/syft/pkg/cataloger/binary/classifiers.go @@ -727,6 +727,32 @@ func DefaultClassifiers() []binutils.Classifier { PURL: mustPURL("pkg:generic/grafana@version"), CPEs: singleCPE("cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource), }, + { + Class: "envoy-binary", + FileGlob: "**/envoy", + EvidenceMatcher: binutils.MatchAny( + // 1.3x [NUL]1.36.4[NUL]...envoy_reloadable_features + // 1.34.5 [NUL]1.34.5[NUL]...envoy.reloadable_features + m.FileContentsVersionMatcher(`(?s)\x00(?P1\.3[0-9]\.[0-9]+(-dev)?)\x00.{0,1000}envoy_reloadable_features`), + m.FileContentsVersionMatcher(`(?s)\x00(?P1\.34\.5)\x00.{0,200}envoy\.reloadable_features`), + // 1.2x envoy_quic_...[NUL]1.28.7[NUL] + m.FileContentsVersionMatcher(`(?s)envoy_quic_.{0,1000}\x00(?P1\.2[0-9]\.[0-9]+(-dev)?)\x00`), + // 1.2x [NUL]1.20.7[NUL]Unable to + // 1.1x [NUL]1.18.6-dev[NUL]Unable to + m.FileContentsVersionMatcher(`(?s)\x00(?P1\.[12][0-9]\.[0-9]+(-dev)?)\x00.{0,1000}Unable to`), + // 1.2x [NUL]1.22.11[NUL]...ValidationError + // 1.1x [NUL]1.14.3[NUL]...ValidationError + m.FileContentsVersionMatcher(`(?s)\x00(?P1\.2[0-9]\.[0-9]+(-dev)?)\x00.{0,580}ValidationError`), + m.FileContentsVersionMatcher(`(?s)\x00(?P1\.1[0-9]\.[0-9]+(-dev)?)\x00.{0,1000}ValidationError`), + // 1.1x [source...[NUL]1.11.0[NUL]/ + m.FileContentsVersionMatcher(`(?s)\[source/.{0,200}\x00(?P1\.1[0-9]\.[0-9]+(-dev)?)\x00`), + // 1.x [NUL]1.6.0[NUL]RELEASE + m.FileContentsVersionMatcher(`(?s)\x00(?P1\.[0-9]\.[0-9]+(-dev)?)\x00.{0,20}RELEASE`), + ), + Package: "envoy", + PURL: mustPURL("pkg:generic/envoy@version"), + CPEs: singleCPE("cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource), + }, } return append(classifiers, defaultJavaClassifiers()...) diff --git a/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.11.0/linux-amd64/envoy b/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.11.0/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..ef3062a2c8e6a2fb2f43b11790d5ece5947eb2c8 GIT binary patch literal 428 zcmZ8dJ#XY75OwWefwXmYF&J#Njnbw`8J$*mcz97TSOzEAe;=QeYp$F3X5NP;*#%dI z^qC)R_P(HAnHUY%vW-Y{y&sVCwxqDGsBd>Gl)f_U6(2pQ=Y!!RSvNU&r!n@B5R>zh z(njgYLkUmEiFHzsUN{FakXEe^5&z7Tv(w;sFSRkGJeQ+12h;aMC!xSKbq9H9rGXns zYAHK4@u4>$2yNQ-bULx=QNey|vYMICG3GCJtlGN`sj#wwf)8*_*@*ymOz$P{8{tBE zS#r80)UUjKTwE%*u&nV+bnV3WhrRs$&&xMqtsy5C5~C-(p)j&BPL@8J?%Z`}-n?eE zf%0~kvrij$lxAN`-C&pVUU0kDx{Bu6R?K;O{GUH>D_!QC=ZKpvk3=_$0jd6$`2owK Bi+BJ4 literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.14.3/linux-amd64/envoy b/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.14.3/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..36e4fd4a4a8646e59c81f5a412346ba5a9dfa4ad GIT binary patch literal 849 zcma))TWcFJ5QX=7e}!nC3PtSwV#q_WQ~HqF!49R+hh-#3g`n~AK;YbY2mnaG;Fh`SU}2v)XT*+pqlH5qTQZK^KoQmHgPo7D&n&t=VIRu){8 zbpu(`iyD}08OSEK$S&UXWfdhI@+#IuE~+*wMBjI5dUJC_*eM`+!X&{GX|=ZBNi3x} zydw|W&Ev4%tnc2E+gp+)In66tCLD~hfq?gFZ^$_7peBt33_n=s&pzQ0ZDUHrSb@nU zDGFj#h8|10L>H7)90IN|fYP3NbPDuf=8>UGb~F2iJiOOo9X@E__6$pAt)^!}Bm0`znM`htPZMA$P773Mdde~D+Oe#Lnfb338f+Bu+K zUeH(bIMLO~z^M4{rFt!TdPL{rLkDG~ebsUK*Gx_@>Zg`#N|ad}d~h(Ghq0YaP$S;M z2_4-A;jgC%g2|nDqD$^s3?u&Y9qKq3>pp{40?ygrIcHrGIX&_@s3Q*bmmkT8IMvzV g13Hc-z#cy-qsDpsXnpX>*EdJdGsd6e17S$?PoAGBGynhq literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.18.6/linux-amd64/envoy b/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.18.6/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..c3f84354b05ee82fdaca5aa0a442f2d46edde448 GIT binary patch literal 349 zcmXv~yKcfT6!o01xDqqSkJxdtp|(p!sZ`W~@!Gx)QBxZc1EQ$^-c)MW^VUiDNgYtS z>Xy>)HfkZEd_zs+FDs z24P*>7!{m}F4o!+H(FC{xy42{RUAh84+~Bkt{sLJxpXaBkE))PQqL=lblk_eN*T1m zC?|X)xsrayrT0jYSJh&%0Cy_{e>0(Ehd6?_ReZFt`ro0O$0P@-;ymXbdnv1$Xv%K4BShf_yH^ Q9G53d{ruqZVALis|;{X5v literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.20.7/linux-amd64/envoy b/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.20.7/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..b1924313c30c4b58095763386099e4c19e695850 GIT binary patch literal 349 zcmXw#O>4qH6h*VnuXx~EN#-k=?27HCSPPXdT)xS?mkdp3#Egna|9chM^}U>XIT639 z1B&N#Efe!hxdSastFg5M6!h7@0x5TYV8F(=RU54;b+=Jdt+b~I!y~35#sU)8|Gw1iUaCF5_h#nJ z%p@+*BbaV(&7IZ(VvkruFy}nCFrDMrqXt)bn9MvwJdOfWmI##ALq)j4b;Y0)q~@4{ zY&z1^yrYbF{&FvyFqnBO$G28+M()NQW4r# zgVIz203(8G-Bm458tnjDf*^t4HVMeUC{ocBov&R3Usg_ zLV5>)#u(?&m*ui7#n$8O-P>9iS1Kn%xvfeoB7|7pz=x!NN*|;1>-RZ%_DDe##)cx> zn1zDbgG_XF(jem1L+G>p+iX6qW{*w^`{d2pOvkH~5W;f;?_WWFBzYMVesor4_v<7s dMn1c1gu5+l_|NW-utsei?7eqBJA(8O-vNz3w}$`# literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.28.7/linux-amd64/envoy b/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.28.7/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..41cdbc07ec66af2a17b75b1abbc1e4910d0d2664 GIT binary patch literal 829 zcmaJ<%Wm5+5Y*XUK_HhFC>+V69yXc+ip4raWyz6c_i-T@K4PL0sY-ML7y0-yi5v9P z};R(&t*_CRM*ya1FXu`dD^ zve1`&MuPxKo+c9V5Qf1F$}|lnOrx1#VZucmNy-!EJ2*_k0Mdz6t@ukO=b;}-DS{+O z1IZ&6@p(KCAPgytMIb^LCoz{W_Gd{DMX3-Xfso2DoyRZ??1u=#FN;APezx3$j- zoRb&L*@ef3HoBYM>mSoqJGwIGR ztFHyhSB`y)ng*9EZ?8sW%>dL0^s#MwJA42Ks(GvQJ?IBz24zn`X>bsfi(v$ky4Ufk zhxG$(6$dx3{S7^}hVoo6<6w)$x!zi8UBJBjq-m!Zu=K8VZ&JSnIQHDlfHoG;=T`~t zz2uPmIx0qb$^@~h6GUlih&BuwnV@0RKKq{$Z-M3a6+yJ!6mm+^vKOPp`yOm zJ=cmcMW`5&Q(8NL%qcOB^C&qJqnf#Foe%U8ra02XwB{3=CCZ7NL3$eHXk>4=?FEjU z4TJ5KGxI<+8%1mq+z4ibBG1q{ZRDy;YI%ij#}P0C gMhlsK9X_ASR}N5;FROu?-y(9etP_;_T^+&5jT%%CL9W{|ua zjhVV`f{8a%4|-Oz?+t$#`*vt`-`Gx$vNgIL#*TNqw9dmj8JGP$H8VGpZjI^34A*U= zMl~CiNn1Y1$tuM`wVbz&;Z{9pW%9aF4e+@v4~GL&cLMfTCL?4Py~i8NtI`EZ#S3ph+$6yN# zUto=(Gu(W2;LT@T77WFUNtKZ#D~wuJ*S`9m>o=6<3090$h5S_`7NF>KDo!sHr6#7O z_t{N02+K-$rZ#IK7N62_U!g8ezr^pS$LA9(;0l3+0kxe)Kms9+5qX;2IZu7@mSwGX zJ?~{B=N;WEt&82ah~Tp*sXPb^lC}s*K-l|?%+AuDhr&gPoEw3D&Hn>%HcqQhIea7D XekPI&XAhKPO`A$Oy7iSK{g31i(1r$Z literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.6.0/linux-amd64/envoy b/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/envoy/1.6.0/linux-amd64/envoy new file mode 100644 index 0000000000000000000000000000000000000000..f302a66f1980bd3484b85aed0a791f0116c15d12 GIT binary patch literal 349 zcmYL_&1%Ci5QKI1QwVZT^>5j?9&+occ>uFotrCMO8CyvSA@ANC5(;w|_+Xfs0zWiz zD%X1JYDycmk$d5dGqTH6PVGE$sYJJxd0D6(&!DUuxkVqPHE5+Ir;Qi}3{HiRJUOep za5^Cv*$V>+HF!%_nh4QB7zk4A(wylX7IoBGIngULM1C;n1VC~IlK>sOh*HO%QV*g} zRs^y}1vfZEtDNa&*X?#Y9&U~Jt0r%ir