oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2025-11-17 08:23:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix ELF package correlations (#3151)

Browse Source
This commit is contained in:
Alex Goodman 2024-08-26 08:44:39 -04:00 committed by GitHub
parent dad253785e
commit b6b5c8e308
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 28 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
internal/relationship/binary/binary_dependencies.go
View File

@ -36,8 +36,7 @@ func generateRelationships(resolver file.Resolver, accessor sbomsync.Accessor, i
newRelationships.Add(r) newRelationships.Add(r)
} }
} }
for _, parentPkg := range allElfPackages(s) {
for _, parentPkg := range s.Artifacts.Packages.Sorted(pkg.BinaryPkg) {
for _, evidentLocation := range parentPkg.Locations.ToSlice() { for _, evidentLocation := range parentPkg.Locations.ToSlice() {
if evidentLocation.Annotations[pkg.EvidenceAnnotationKey] != pkg.PrimaryEvidenceAnnotation { if evidentLocation.Annotations[pkg.EvidenceAnnotationKey] != pkg.PrimaryEvidenceAnnotation {
continue continue
@ -101,7 +100,7 @@ func onlyPrimaryEvidenceLocations(p pkg.Package) []file.Location {
func allElfPackages(s *sbom.SBOM) []pkg.Package { func allElfPackages(s *sbom.SBOM) []pkg.Package {
var elfPkgs []pkg.Package var elfPkgs []pkg.Package
for _, p := range s.Artifacts.Packages.Sorted(pkg.BinaryPkg) { for _, p := range s.Artifacts.Packages.Sorted() {
if !isElfPackage(p) { if !isElfPackage(p) {
continue continue
} }

30
internal/relationship/binary/binary_dependencies_test.go
View File

@ -50,6 +50,22 @@ func TestPackagesToRemove(t *testing.T) {
} }
glibCBinaryELFPackage.SetID() glibCBinaryELFPackage.SetID()
glibCBinaryELFPackageAsRPM := pkg.Package{
Name: "glibc",
Locations: file.NewLocationSet(
file.NewLocation(glibcCoordinate.RealPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
),
Type: pkg.RpmPkg, // note: the elf package claims it is a RPM, not binary
Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
Type: "rpm",
Vendor: "syft",
System: "syftsys",
SourceRepo: "https://github.com/someone/somewhere.git",
Commit: "5534c38d0ffef9a3f83154f0b7a7fb6ab0ab6dbb",
},
}
glibCBinaryELFPackageAsRPM.SetID()
glibCBinaryClassifierPackage := pkg.Package{ glibCBinaryClassifierPackage := pkg.Package{
Name: "glibc", Name: "glibc",
Locations: file.NewLocationSet( Locations: file.NewLocationSet(
@ -83,9 +99,15 @@ func TestPackagesToRemove(t *testing.T) {
want: []artifact.ID{glibCBinaryELFPackage.ID()}, want: []artifact.ID{glibCBinaryELFPackage.ID()},
}, },
{ {
name: "remove no packages when there is a single binary package", name: "keep packages that are overlapping rpm --> binary when the binary self identifies as an RPM",
resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath), resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
accessor: newAccessor([]pkg.Package{glibCBinaryELFPackage}, map[file.Coordinates]file.Executable{}, nil), accessor: newAccessor([]pkg.Package{glibCPackage, glibCBinaryELFPackageAsRPM}, map[file.Coordinates]file.Executable{}, nil),
want: []artifact.ID{},
},
{
name: "remove no packages when there is a single binary package (or self identifying RPM)",
resolver: file.NewMockResolverForPaths(glibcCoordinate.RealPath),
accessor: newAccessor([]pkg.Package{glibCBinaryELFPackage, glibCBinaryELFPackageAsRPM}, map[file.Coordinates]file.Executable{}, nil),
want: []artifact.ID{}, want: []artifact.ID{},
}, },
{ {
@ -173,9 +195,9 @@ func TestNewDependencyRelationships(t *testing.T) {
file.NewLocation(parallelLibCoordinate.RealPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation), file.NewLocation(parallelLibCoordinate.RealPath).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.SupportingEvidenceAnnotation),
), ),
Language: "", Language: "",
Type: pkg.BinaryPkg, Type: pkg.RpmPkg,
Metadata: pkg.ELFBinaryPackageNoteJSONPayload{ Metadata: pkg.ELFBinaryPackageNoteJSONPayload{
Type: "testfixture", Type: "rpm",
Vendor: "syft", Vendor: "syft",
System: "syftsys", System: "syftsys",
SourceRepo: "https://github.com/someone/somewhere.git", SourceRepo: "https://github.com/someone/somewhere.git",