oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 16:48:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(binary): require gzip identity evidence in gzip classifier

Browse Source 
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
This commit is contained in:
Christopher Phillips 2026-08-13 13:35:48 -04:00
parent 68da404bd7
commit 83dfbcc24a
No known key found for this signature in database
3 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
syft/pkg/cataloger/binary/classifiers.go
View File

@ -898,7 +898,13 @@ func DefaultClassifiers() []binutils.Classifier {
{ {
Class: "gzip-binary", Class: "gzip-binary",
FileGlob: "**/gzip", FileGlob: "**/gzip",
// GNU gzip assembles its version banner at runtime from argv[0], so the version is stored as a
// bare NUL-delimited token with nothing to anchor against. Require a gzip-specific string
// elsewhere in the file before trusting that token, otherwise any binary reachable by a path
// named "gzip" (such as the busybox multicall binary, which provides a gzip applet by symlink)
// is reported as GNU gzip with an arbitrary version.
EvidenceMatcher: m.FileContentsVersionMatcher( EvidenceMatcher: m.FileContentsVersionMatcher(
`not in gzip format|bug-gzip@gnu\.org|GZIP environment variable`,
`\x00(?P<version>[0-9]+\.[0-9]+)\x00`, `\x00(?P<version>[0-9]+\.[0-9]+)\x00`,
), ),
Package: "gzip", Package: "gzip",

BIN
syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip vendored Normal file
View File

Binary file not shown.

BIN
syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip vendored
View File

Binary file not shown.