oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-31 14:36:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: only look up owned-by-package files in the resolver's own frame

Browse Source 
with `FilesOwnedByPackageSelection` the file catalogers take every package location in the SBOM and look it up by `RealPath` in the resolver they were given. Inside an archive, the java package's location is the archive itself *in its parent's frame* (`WEB-INF/lib/dep.jar`), so the sub-pipeline looked that path up inside `dep.jar`'s own resolver: a miss, or an unrelated same-named entry by coincidence. At the root, coordinates from inside archives were looked up against the scan root the same way.

`coordinatesForSelection` now keeps only coordinates whose `ArchivePath` matches the current frame (the traversal's `ContentsArchivePath()`, or blank at the root).

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman
2026-09-24 13:30:33 -04:00
parent 0152e5b59c
commit 9d820c6d94
4 changed files with 53 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/task/file_tasks.go
+16 -4
View File
@@ -4,6 +4,7 @@ import (
"context"
"crypto"
"github.com/anchore/syft/internal/archive"
"github.com/anchore/syft/internal/sbomsync"
"github.com/anchore/syft/syft/artifact"
"github.com/anchore/syft/syft/cataloging/filecataloging"
@@ -39,7 +40,7 @@ func newFileDigestCatalogerTask(selection file.Selection, hashers []crypto.Hash,
accessor := builder.(sbomsync.Accessor)
coordinates, ok := coordinatesForSelection(selection, builder.(sbomsync.Accessor))
coordinates, ok := coordinatesForSelection(ctx, selection, builder.(sbomsync.Accessor))
if !ok {
return nil
}
@@ -70,7 +71,7 @@ func newFileMetadataCatalogerTask(selection file.Selection, tags ...string) Task
accessor := builder.(sbomsync.Accessor)
coordinates, ok := coordinatesForSelection(selection, builder.(sbomsync.Accessor))
coordinates, ok := coordinatesForSelection(ctx, selection, builder.(sbomsync.Accessor))
if !ok {
return nil
}
@@ -141,7 +142,12 @@ func newExecutableCatalogerTask(selection file.Selection, cfg executable.Config,
// TODO: this should be replaced with a fix that allows passing a coordinate or location iterator to the cataloger
// Today internal to both cataloger this functions differently: a slice of coordinates vs a channel of locations
func coordinatesForSelection(selection file.Selection, accessor sbomsync.Accessor) ([]file.Coordinates, bool) {
//
// Only coordinates in the resolver's own frame are returned: inside an archive, the files of that archive,
// and at the scan root, files outside any archive. A package's location can be in another frame (a nested
// java package is located at the archive in its parent), and looking that path up here would miss or,
// worse, hit an unrelated file of the same name.
func coordinatesForSelection(ctx context.Context, selection file.Selection, accessor sbomsync.Accessor) ([]file.Coordinates, bool) {
if selection == file.AllFilesSelection {
return nil, true
}
@@ -169,7 +175,13 @@ func coordinatesForSelection(selection file.Selection, accessor sbomsync.Accesso
}
})
coords := coordinates.ToSlice()
frame := archive.TraversalFromContext(ctx).ContentsArchivePath()
var coords []file.Coordinates
for _, c := range coordinates.ToSlice() {
if c.ArchivePath == frame {
coords = append(coords, c)
}
}
if len(coords) == 0 {
return nil, false