oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 15:36:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: remove APK OriginPackage cpe candidates (#1637)

Browse Source 
Adding APK OriginPackage CPE candidates to the child package
results in false positives in grype because it can't associate
CPE-based findings to the corresponding OriginPackage APK fixes.

This reverts changing the `upstream` in the PURL for APK packages
as the logic in Grype that uses it expects it to be an APK package
name.  This also allows refactoring to unexport and move the APK
CPE candidate generation logic closer to where CPE generation occurs

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
This commit is contained in:
Weston Steimel
2023-03-01 17:24:43 +00:00
committed by GitHub
parent 2e6e3b0c74
commit e2ebc9769f
7 changed files with 303 additions and 454 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/apkdb/package.go
+2 -8
View File
@@ -36,14 +36,8 @@ func packageURL(m pkg.ApkMetadata, distro *linux.Release) string {
pkg.PURLQualifierArch: m.Architecture,
}
upstreams := m.UpstreamCandidates()
if len(upstreams) > 0 {
// only room for one value so for now just take the first one
upstream := upstreams[0]
if upstream.Name != "" && upstream.Name != m.Package {
qualifiers[pkg.PURLQualifierUpstream] = upstream.Name
}
if m.OriginPackage != m.Package {
qualifiers[pkg.PURLQualifierUpstream] = m.OriginPackage
}
return packageurl.NewPackageURL(
syft/pkg/cataloger/apkdb/package_test.go
-140
View File
@@ -96,146 +96,6 @@ func Test_PackageURL(t *testing.T) {
},
expected: "pkg:apk/alpine/p@v?arch=a&upstream=origin&distro=alpine-3.4.6",
},
{
name: "upstream python package information as qualifier",
metadata: pkg.ApkMetadata{
Package: "py3-potatoes",
Version: "v",
Architecture: "a",
OriginPackage: "py3-potatoes",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/py3-potatoes@v?arch=a&upstream=potatoes&distro=alpine-3.4.6",
},
{
name: "python package with origin package as upstream",
metadata: pkg.ApkMetadata{
Package: "py3-non-existant",
Version: "v",
Architecture: "a",
OriginPackage: "abcdefg",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/py3-non-existant@v?arch=a&upstream=abcdefg&distro=alpine-3.4.6",
},
{
name: "postgesql-15 upstream postgresql",
metadata: pkg.ApkMetadata{
Package: "postgresql-15",
Version: "15.0",
Architecture: "a",
OriginPackage: "postgresql-15",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/postgresql-15@15.0?arch=a&upstream=postgresql&distro=alpine-3.4.6",
},
{
name: "postgesql15 upstream postgresql",
metadata: pkg.ApkMetadata{
Package: "postgresql15",
Version: "15.0",
Architecture: "a",
OriginPackage: "postgresql15",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/postgresql15@15.0?arch=a&upstream=postgresql&distro=alpine-3.4.6",
},
{
name: "go-1.19 upstream go",
metadata: pkg.ApkMetadata{
Package: "go-1.19",
Version: "1.19",
Architecture: "a",
OriginPackage: "go-1.19",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/go-1.19@1.19?arch=a&upstream=go&distro=alpine-3.4.6",
},
{
name: "go1.19 upstream go",
metadata: pkg.ApkMetadata{
Package: "go1.19",
Version: "1.19",
Architecture: "a",
OriginPackage: "go1.19",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/go1.19@1.19?arch=a&upstream=go&distro=alpine-3.4.6",
},
{
name: "abc-101.191.23456 upstream abc",
metadata: pkg.ApkMetadata{
Package: "abc-101.191.23456",
Version: "101.191.23456",
Architecture: "a",
OriginPackage: "abc-101.191.23456",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/abc-101.191.23456@101.191.23456?arch=a&upstream=abc&distro=alpine-3.4.6",
},
{
name: "abc101.191.23456 upstream abc",
metadata: pkg.ApkMetadata{
Package: "abc101.191.23456",
Version: "101.191.23456",
Architecture: "a",
OriginPackage: "abc101.191.23456",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/abc101.191.23456@101.191.23456?arch=a&upstream=abc&distro=alpine-3.4.6",
},
{
name: "abc101-12345-1045 upstream abc101-12345",
metadata: pkg.ApkMetadata{
Package: "abc101-12345-1045",
Version: "101.191.23456",
Architecture: "a",
OriginPackage: "abc101-12345-1045",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/abc101-12345-1045@101.191.23456?arch=a&upstream=abc101-12345&distro=alpine-3.4.6",
},
{
name: "abc101-a12345-1045 upstream abc101-a12345",
metadata: pkg.ApkMetadata{
Package: "abc101-a12345-1045",
Version: "101.191.23456",
Architecture: "a",
OriginPackage: "abc101-a12345-1045",
},
distro: linux.Release{
ID: "alpine",
VersionID: "3.4.6",
},
expected: "pkg:apk/alpine/abc101-a12345-1045@101.191.23456?arch=a&upstream=abc-a12345-1045&distro=alpine-3.4.6",
},
{
name: "wolfi distro",
metadata: pkg.ApkMetadata{