From d3734ddeb2d6a7e861355dd6facb730dd4d46537 Mon Sep 17 00:00:00 2001 From: Pujitha Paladugu Date: Wed, 26 Aug 2026 21:20:09 -0700 Subject: [PATCH] fix(binary): detect grafana security-patch release versions (#5213) --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --- .../binary/classifier_cataloger_test.go | 33 ++++++++++++++++++ syft/pkg/cataloger/binary/classifiers.go | 5 +++ .../11.0.5-security-01/linux-amd64/grafana | Bin 0 -> 352 bytes .../12.0.0-security-01/linux-amd64/grafana | Bin 0 -> 352 bytes .../12.4.3-security-02/linux-arm/grafana | Bin 0 -> 353 bytes .../pkg/cataloger/binary/testdata/config.yaml | 24 +++++++++++++ 6 files changed, 62 insertions(+) create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/11.0.5-security-01/linux-amd64/grafana create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/12.0.0-security-01/linux-amd64/grafana create mode 100644 syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/12.4.3-security-02/linux-arm/grafana diff --git a/syft/pkg/cataloger/binary/classifier_cataloger_test.go b/syft/pkg/cataloger/binary/classifier_cataloger_test.go index d8d3567ff..4b4e2ed7d 100644 --- a/syft/pkg/cataloger/binary/classifier_cataloger_test.go +++ b/syft/pkg/cataloger/binary/classifier_cataloger_test.go @@ -2294,6 +2294,39 @@ func Test_Cataloger_PositiveCases(t *testing.T) { Metadata: metadata("grafana-binary"), }, }, + { + logicalFixture: "grafana/12.4.3-security-02/linux-arm", + expected: pkg.Package{ + Name: "grafana", + Version: "12.4.3", + Type: "binary", + PURL: "pkg:generic/grafana@12.4.3", + Locations: locations("grafana"), + Metadata: metadata("grafana-binary"), + }, + }, + { + logicalFixture: "grafana/12.0.0-security-01/linux-amd64", + expected: pkg.Package{ + Name: "grafana", + Version: "12.0.0", + Type: "binary", + PURL: "pkg:generic/grafana@12.0.0", + Locations: locations("grafana"), + Metadata: metadata("grafana-binary"), + }, + }, + { + logicalFixture: "grafana/11.0.5-security-01/linux-amd64", + expected: pkg.Package{ + Name: "grafana", + Version: "11.0.5", + Type: "binary", + PURL: "pkg:generic/grafana@11.0.5", + Locations: locations("grafana"), + Metadata: metadata("grafana-binary"), + }, + }, { logicalFixture: "grafana/12.3.1/linux-amd64", expected: pkg.Package{ diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go index 26fd9ce7f..5fc3c7b80 100644 --- a/syft/pkg/cataloger/binary/classifiers.go +++ b/syft/pkg/cataloger/binary/classifiers.go @@ -1054,6 +1054,11 @@ func DefaultClassifiers() []binutils.Classifier { EvidenceMatcher: binutils.MatchAny( // [NUL][NUL][NUL][NUL]12.2.0-258092[NUL][NUL][NUL][NUL] m.FileContentsVersionMatcher(`\x00+(?P[0-9]{2}\.[0-9]+\.[0-9]+\-[0-9]{6,})\x00+`), + // security patch releases embed the raw version constant with no "release-" prefix + // and are not always preceded by NUL bytes (e.g. on arm builds): + // [NUL]11.0.5+security-01[NUL][NUL]call frame too large + // [NUL]12.4.3+security-02[NUL][NUL] + m.FileContentsVersionMatcher(`\x00(?P[0-9]{1,2}\.[0-9]+\.[0-9]+)\+security-[0-9]+\x00`), // [NUL][NUL][NUL][NUL]release-12.3.2+security-01[NUL][NUL][NUL][NUL] // [NUL][NUL][NUL][NUL]release-12.3.1[NUL][NUL][NUL][NUL] m.FileContentsVersionMatcher(`\x00+release-(?P[0-9]{2}\.[0-9]+\.[0-9]+(-beta[0-9]|-test|-preview)?)(\+security-[0-9]+)?\x00+`), diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/11.0.5-security-01/linux-amd64/grafana b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/11.0.5-security-01/linux-amd64/grafana new file mode 100644 index 0000000000000000000000000000000000000000..0aacb4de3d5815d4b7673d4aa41d3b9453d789cb GIT binary patch literal 352 zcmXv~yKciU5NlU`KxY9Niv~J9BY#Afe!=NaX>aI(AEKB<4T@5u0#Pag-gA$FRwwUK-VNH$sIC_qTg zR7wWDlq^yaiDC$_OF2~7Igk>;dCD$=l4IkwOtMAi8JQfUB;>2{JlBddMXF0Bmujn! zVDN>ZKuo}iYKegghpg0Qv(e=`v3|_d)1YN&ZTQl2q@HHDpZDiQUly7Hur=H8dSUt; okJI(dz};V&ur)2?{GqvQ&<)2uui2uvJHGGU??eA?>&+7X15e9f%m4rY literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/12.0.0-security-01/linux-amd64/grafana b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/12.0.0-security-01/linux-amd64/grafana new file mode 100644 index 0000000000000000000000000000000000000000..c8b3fbe79e08c2f3d9467e5f0726b86367bed4be GIT binary patch literal 352 zcmX|7%TB{U46MX$zhb2v5!KrJ%H}ut0;jRlN=s5DL8vFh5Ab_j`2;RV+{%WQ&cQR9 zu|}2$dg4a+6A2BZMv$ z*kG-vqH2oC3JHU7O<;|PX_-*4tjE-POr4TL=37}pgf^MbhRD$Xr49nbx^+x8y68La zqfdY-#?l#GvCvUO4#}FDm8z;rx2J{m^-R5tTE?8m7hNK?S@HdLx6%Vm%7;qXs54DH-@+o!7rb7)uPgtY|995-7dtLsIsgCw literal 0 HcmV?d00001 diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/12.4.3-security-02/linux-arm/grafana b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/grafana/12.4.3-security-02/linux-arm/grafana new file mode 100644 index 0000000000000000000000000000000000000000..44469b80a156b8f42c9e5092b4c59eb011759d29 GIT binary patch literal 353 zcmY+8y-EW?9K;u^%XSu~UQ8*5{kZ)K7!U+aZEbP8_upLLybH;RNh=nDuiy*V1j|&x z(#j&1BH9SvTX+FeI55Th28Jn;OX!i|Bne58;4*|MR6W8B*HlW)aSp|>${NBco))9= z7^?Fu;ZpTTnrdcDOgW=IFbXDS)LLNNcmY}nMH#c!)6{!y1jI@h9bzfLXlZGPaTw*W z9dn?;C>J~Kz-s4R%9ZfKX``s%Dp;3r1CpmyFzKa9v{Y#jJTx>|V=(S?I>gN@Ab&SW zRgzHVd3jBm3Zwtp-$cf{aaSBn!Cy^A)%=ihgrbu=diubv$H8Lpa@0oIaT_iBbu>Gz pqldxU{q5Z@`f8k=)zR`3w^seV_49fMZM