From ee4e69285a3926bdf19c2901131fccf9c1ebe5d0 Mon Sep 17 00:00:00 2001 From: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com> Date: Tue, 31 Oct 2023 15:33:52 -0400 Subject: [PATCH] test: remove dll files and updates tests to use versionResources (#2276) * test: remove dll files and updates tests to use versionResources Signed-off-by: Christopher Phillips * test: update integration tests with dot net coverage Signed-off-by: Christopher Phillips * chore: move test cases to appropriate blocks Signed-off-by: Christopher Phillips * fix: chmod only the dll Signed-off-by: Christopher Phillips * fix: add primary annotation key to packages Signed-off-by: Christopher Phillips * chore: bump number of packages with new dotnet package Signed-off-by: Christopher Phillips --------- Signed-off-by: Christopher Phillips --- .../parse_dotnet_portable_executable.go | 27 ++-- .../parse_dotnet_portable_executable_test.go | 119 ++++++++++-------- .../dotnet/test-fixtures/System.Buffers.dll | Bin 5120 -> 0 bytes test/cli/packages_cmd_test.go | 2 +- .../catalog_packages_cases_test.go | 8 ++ test/integration/catalog_packages_test.go | 2 - .../image-pkg-coverage/Dockerfile | 12 +- 7 files changed, 103 insertions(+), 67 deletions(-) delete mode 100644 syft/pkg/cataloger/dotnet/test-fixtures/System.Buffers.dll diff --git a/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable.go b/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable.go index 3ce5bc7ba..ca28d5216 100644 --- a/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable.go +++ b/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable.go @@ -42,16 +42,26 @@ func parseDotnetPortableExecutable(_ file.Resolver, _ *generic.Environment, f fi return nil, nil, nil } + dotNetPkg, err := buildDotNetPackage(versionResources, f) + if err != nil { + // this is not a fatal error, just log and continue + // TODO: consider this case for "known unknowns" (same goes for cases below) + log.Tracef("unable to build dotnet package: %w", err) + return nil, nil, nil + } + + return []pkg.Package{dotNetPkg}, nil, nil +} + +func buildDotNetPackage(versionResources map[string]string, f file.LocationReadCloser) (dnpkg pkg.Package, err error) { name := findName(versionResources) if name == "" { - log.Tracef("unable to find FileDescription, or ProductName in PE file: %s", f.RealPath) - return nil, nil, nil + return dnpkg, fmt.Errorf("unable to find FileDescription, or ProductName in PE file: %s", f.RealPath) } version := findVersion(versionResources) if strings.TrimSpace(version) == "" { - log.Tracef("unable to find FileVersion in PE file: %s", f.RealPath) - return nil, nil, nil + return dnpkg, fmt.Errorf("unable to find FileVersion in PE file: %s", f.RealPath) } purl := packageurl.NewPackageURL( @@ -73,18 +83,19 @@ func parseDotnetPortableExecutable(_ file.Resolver, _ *generic.Environment, f fi ProductVersion: versionResources["ProductVersion"], } - p := pkg.Package{ + dnpkg = pkg.Package{ Name: name, Version: version, - Locations: file.NewLocationSet(f.Location), + Locations: file.NewLocationSet(f.Location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)), Type: pkg.DotnetPkg, + Language: pkg.Dotnet, PURL: purl, Metadata: metadata, } - p.SetID() + dnpkg.SetID() - return []pkg.Package{p}, nil, nil + return dnpkg, nil } func findVersion(versionResources map[string]string) string { diff --git a/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable_test.go b/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable_test.go index 6bdf41dcb..84daa4f4e 100644 --- a/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable_test.go +++ b/syft/pkg/cataloger/dotnet/parse_dotnet_portable_executable_test.go @@ -3,7 +3,8 @@ package dotnet import ( "testing" - "github.com/anchore/syft/syft/artifact" + "github.com/stretchr/testify/assert" + "github.com/anchore/syft/syft/file" "github.com/anchore/syft/syft/pkg" "github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest" @@ -11,73 +12,81 @@ import ( func TestParseDotnetPortableExecutable(t *testing.T) { tests := []struct { - fixture string - expected []pkg.Package + name string + versionResources map[string]string + expectedPackage pkg.Package }{ { - fixture: "test-fixtures/System.Buffers.dll", - expected: []pkg.Package{ - { - Name: "System.Buffers", - Version: "7.0.923.36201", - Type: pkg.DotnetPkg, - PURL: "pkg:nuget/System.Buffers@7.0.923.36201", - Metadata: pkg.DotnetPortableExecutableEntry{ - AssemblyVersion: "7.0.0.0", - LegalCopyright: "© Microsoft Corporation. All rights reserved.", - Comments: "System.Buffers", - InternalName: "System.Buffers.dll", - CompanyName: "Microsoft Corporation", - ProductName: "Microsoft® .NET", - ProductVersion: "7.0.9+8e9a17b2216f51a5788f8b1c467a4cf3b769e7d7", - }, + name: "dotnet package with extra version info", + versionResources: map[string]string{ + "InternalName": "Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll", + "FileVersion": "3.14.40721.0918 xxxfffdddjjjj", + "FileDescription": "Active Directory Authentication Library", + "ProductName": "Active Directory Authentication Library", + "Comments": "", + "CompanyName": "Microsoft Corporation", + "LegalTrademarks": "", + "LegalCopyright": "Copyright (c) Microsoft Corporation. All rights reserved.", + "OriginalFilename": "Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll", + "ProductVersion": "c61f043686a544863efc014114c42e844f905336", + "Assembly Version": "3.14.2.11", + }, + expectedPackage: pkg.Package{ + Name: "ActiveDirectoryAuthenticationLibrary", + Version: "3.14.40721.0918", + Locations: file.NewLocationSet(file.NewLocation("").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)), + Type: pkg.DotnetPkg, + Language: pkg.Dotnet, + PURL: "pkg:nuget/ActiveDirectoryAuthenticationLibrary@3.14.40721.0918", + Metadata: pkg.DotnetPortableExecutableEntry{ + AssemblyVersion: "3.14.2.11", + LegalCopyright: "Copyright (c) Microsoft Corporation. All rights reserved.", + InternalName: "Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll", + CompanyName: "Microsoft Corporation", + ProductName: "Active Directory Authentication Library", + ProductVersion: "c61f043686a544863efc014114c42e844f905336", }, }, }, { - fixture: "test-fixtures/Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll", - expected: []pkg.Package{ - { - Name: "ActiveDirectoryAuthenticationLibrary", - Version: "3.14.40721.0918", - Type: pkg.DotnetPkg, - PURL: "pkg:nuget/ActiveDirectoryAuthenticationLibrary@3.14.40721.0918", - Metadata: pkg.DotnetPortableExecutableEntry{ - AssemblyVersion: "3.14.2.11", - LegalCopyright: "Copyright (c) Microsoft Corporation. All rights reserved.", - InternalName: "Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll", - CompanyName: "Microsoft Corporation", - ProductName: "Active Directory Authentication Library", - ProductVersion: "c61f043686a544863efc014114c42e844f905336", - }, - }, + name: "dotnet package with malformed field and extended version", + versionResources: map[string]string{ + "CompanyName": "Microsoft Corporation", + "FileDescription": "äbFileVersion", + "FileVersion": "4.6.25512.01 built by: dlab-DDVSOWINAGE016. Commit Hash: d0d5c7b49271cadb6d97de26d8e623e98abdc8db", + "InternalName": "äbFileVersion", + "LegalCopyright": "© Microsoft Corporation. All rights reserved.", + "OriginalFilename": "TProductName", + "ProductName": "Microsoft® .NET Framework", + "ProductVersion": "4.6.25512.01 built by: dlab-DDVSOWINAGE016. Commit Hash: d0d5c7b49271cadb6d97de26d8e623e98abdc8db", }, - }, - { - fixture: "test-fixtures/sni.dll", - expected: []pkg.Package{ - { - Name: "bFileVersion", - Version: "4.6.25512.01", - Type: pkg.DotnetPkg, - PURL: "pkg:nuget/bFileVersion@4.6.25512.01", - Metadata: pkg.DotnetPortableExecutableEntry{ - LegalCopyright: "© Microsoft Corporation. All rights reserved.", - CompanyName: "Microsoft Corporation", - ProductName: "Microsoft® .NET Framework", - ProductVersion: "4.6.25512.01 built by: dlab-DDVSOWINAGE016. Commit Hash: d0d5c7b49271cadb6d97de26d8e623e98abdc8db", - }, + expectedPackage: pkg.Package{ + Name: "bFileVersion", + Version: "4.6.25512.01", + Locations: file.NewLocationSet( + file.NewLocation("").WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)), + Type: pkg.DotnetPkg, + Language: pkg.Dotnet, + PURL: "pkg:nuget/bFileVersion@4.6.25512.01", + Metadata: pkg.DotnetPortableExecutableEntry{ + LegalCopyright: "© Microsoft Corporation. All rights reserved.", + InternalName: "äb\x01FileVersion", + CompanyName: "Microsoft Corporation", + ProductName: "Microsoft® .NET Framework", + ProductVersion: "4.6.25512.01 built by: dlab-DDVSOWINAGE016. Commit Hash: d0d5c7b49271cadb6d97de26d8e623e98abdc8db", }, }, }, } for _, tc := range tests { - t.Run(tc.fixture, func(t *testing.T) { - fixtureLocationSet := file.NewLocationSet(file.NewLocation(tc.fixture)) - tc.expected[0].Locations = fixtureLocationSet - var expectedRelationships []artifact.Relationship - pkgtest.TestFileParser(t, tc.fixture, parseDotnetPortableExecutable, tc.expected, expectedRelationships) + t.Run(tc.name, func(t *testing.T) { + f := file.LocationReadCloser{ + Location: file.NewLocation(""), + } + got, err := buildDotNetPackage(tc.versionResources, f) + assert.NoErrorf(t, err, "failed to build package from version resources: %+v", tc.versionResources) + pkgtest.AssertPackagesEqual(t, tc.expectedPackage, got) }) } } diff --git a/syft/pkg/cataloger/dotnet/test-fixtures/System.Buffers.dll b/syft/pkg/cataloger/dotnet/test-fixtures/System.Buffers.dll deleted file mode 100644 index a4cfb73e6e3e90e1732861e982a4890962cac0f6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 5120 zcmeHLeQZEyUMN33 z|FE?7^!&ad&63lmkucSy992^(!iVL55Um@;iz#X`q*PY2Ojsfe~c z;C?zk+XY%6PnGJ4Dj+G#N!?4(%BXFqM3sVf<#2NW$1lnlDCB40t%wG9a8v#_(K=l& zLOF6L(K^nw5%rBb;R2@&5`6~jg~ib4Wgn-N$Ds@BGW1s!j8kkjYNKCM4g#H6D{vPU znP^ZkEi($Cz}5z)6qN%iC~ZKmm`pcdC{%+`a$hr03rZVNdqG#Qf5-ZH;n-YMLOn9# zGlhu5DlCIo|5%~mCVYE%b-P58&~hvzKBZo1tZ(!-b5RNDpa-C?y`N|vFn$@eHf)<( zDq(SpQRIN9p|(FvUkAfeS9?!?X9(@X=s(Eq+jS#?J}>A>Q)-C5#XIjyjWi1auzVbE zr=#*Pa6Vs&&Pkl-!IY$Vu2OnJ&{isUO{W&PETzqKOe&=Bc zOwd<_e7m4~1f4JBVeov8X`Eng2{A2lNmK<|N}mI*pe3M{22^^;9DV!0-#?L@nQXsO)7g4vTAGoXtn5t14Ku0QP^$V(twPL- znp&D$O?DAtaW$jcL0wa=3GE6anbvgSxR>ebsNf3p`PKB8h)vX<7?@YAFw$95OAHmL zR;&$kx0onZAnj#wX0lY2x)4KptfX=);6Shg0m@*)R=l8Y2G!^|AfqReuVkLj>&&~?x_ zbBbL?wD_Ht!0YA<-3OOl{N|?T6Mv*)S(3_%WRgn2R8{e=yF_+LZZ~ILWd~XZwpP7f zv21J)EyT4mM)W=dN^>`j317WW~FsC+l{kQ#z)AoDCRfUT#06K!MJ69FF`j`qNz@9 z_<=0$GcznF?J@b*>r6$AQAb)Wk^B05m5A?%IhdhKi<*XI#BCW+(}pR|1W}_z%JFC9 z8)_9fsOz#g2bOFy3wwmc6x{O?O#^tPxuH>M^f%Odb8dvFu8B3P-aw?G!RwDN^{Pt) zO-=Eph&Sr<2UK4)-WUn^n^_OUIpeM^f}87?JK5*|twa)wpFQcRCr&HX-$2eou?lrV8_|3GhlEq! zEAoL`k5|P2Xb1Iz>%>dD8~skumAO|p9V>q8YVKt=g|tU@!vlXwlvAtY2luaYqd5XJ zAyf%oRWjj6!<&-9XNuxv2&0AK1=$C!3aJIXN;d2a^m64u@dnH!0h0|Y4f4bdJo$u8 zJ=UH3_$b0-Kz_U`CA^&sO5(#X+QuvdZ&|c9BuTuy+9?A>ar8`~#qS)vi}K^r0$Uc5 zP=ybUs|!e?ur^?CV5E)B$Y(JrEok8?RtgOH)rT;PCB|y7EnMq=!_-1l{nI8~8f%G2uO) z7@X6 zXahc8WGPNd(W;;USTv#E1g#fne9#7<@qv#cqY?D{@W9ZdqYADEqwTXjvyjg jpu8ClzDM}k__Tb&A|U7fXHY4ApMS!ze+u`1j=+Ba@y|BX diff --git a/test/cli/packages_cmd_test.go b/test/cli/packages_cmd_test.go index 3e2b428e6..89c9a7248 100644 --- a/test/cli/packages_cmd_test.go +++ b/test/cli/packages_cmd_test.go @@ -9,7 +9,7 @@ import ( const ( // this is the number of packages that should be found in the image-pkg-coverage fixture image // when analyzed with the squashed scope. - coverageImageSquashedPackageCount = 24 + coverageImageSquashedPackageCount = 25 ) func TestPackagesCmdFlags(t *testing.T) { diff --git a/test/integration/catalog_packages_cases_test.go b/test/integration/catalog_packages_cases_test.go index 3ff8d307d..3df13864a 100644 --- a/test/integration/catalog_packages_cases_test.go +++ b/test/integration/catalog_packages_cases_test.go @@ -77,6 +77,14 @@ var imageOnlyTestCases = []testCase{ "base": "4.3.0", }, }, + { + name: "find dot net executable", + pkgType: pkg.DotnetPkg, + pkgLanguage: pkg.Dotnet, + pkgInfo: map[string]string{ + "DocuSign.eSign": "6.8.0.0", + }, + }, } var dirOnlyTestCases = []testCase{ diff --git a/test/integration/catalog_packages_test.go b/test/integration/catalog_packages_test.go index d9a99a512..1e8fc1c46 100644 --- a/test/integration/catalog_packages_test.go +++ b/test/integration/catalog_packages_test.go @@ -67,7 +67,6 @@ func TestPkgCoverageImage(t *testing.T) { definedLanguages.Remove(pkg.Go.String()) definedLanguages.Remove(pkg.Rust.String()) definedLanguages.Remove(pkg.Dart.String()) - definedLanguages.Remove(pkg.Dotnet.String()) definedLanguages.Remove(pkg.Swift.String()) definedLanguages.Remove(pkg.CPP.String()) definedLanguages.Remove(pkg.Haskell.String()) @@ -85,7 +84,6 @@ func TestPkgCoverageImage(t *testing.T) { definedPkgs.Remove(string(pkg.GoModulePkg)) definedPkgs.Remove(string(pkg.RustPkg)) definedPkgs.Remove(string(pkg.DartPubPkg)) - definedPkgs.Remove(string(pkg.DotnetPkg)) definedPkgs.Remove(string(pkg.CocoapodsPkg)) definedPkgs.Remove(string(pkg.ConanPkg)) definedPkgs.Remove(string(pkg.HackagePkg)) diff --git a/test/integration/test-fixtures/image-pkg-coverage/Dockerfile b/test/integration/test-fixtures/image-pkg-coverage/Dockerfile index ffbe37e63..17ad2a6f4 100644 --- a/test/integration/test-fixtures/image-pkg-coverage/Dockerfile +++ b/test/integration/test-fixtures/image-pkg-coverage/Dockerfile @@ -1,6 +1,6 @@ FROM fedora:37@sha256:3f987b7657e944cf87a129cc262982d4f80e38bd98f7db313ccaf90ca7069dd2 -RUN dnf install 'dnf-command(download)' cpio xz -y +RUN dnf install 'dnf-command(download)' cpio unzip xz -y # https://dl.fedoraproject.org/pub/fedora/linux/releases/37/Everything/x86_64/os/Packages/k/kernel-6.0.7-301.fc37.x86_64.rpm # https://dl.fedoraproject.org/pub/fedora/linux/releases/37/Everything/x86_64/os/Packages/k/kernel-modules-6.0.7-301.fc37.x86_64.rpm RUN dnf download kernel-core-6.0.7-301.fc37 kernel-modules-6.0.7-301.fc37 -y @@ -13,11 +13,21 @@ RUN rpm2cpio kernel-modules-*.rpm | cpio -t && \ RUN unxz /lib/modules/6.0.7-301.fc37.x86_64/kernel/drivers/tty/ttynull.ko.xz +# dotnet pkg coverage +# https://nuget.info/packages/DocuSign.eSign.dll/6.8.0 +# https://github.com/docusign/docusign-esign-csharp-client/blob/master/LICENSE +RUN curl -LO https://www.nuget.org/api/v2/package/DocuSign.eSign.dll/6.8.0 +RUN unzip 6.8.0 +RUN chmod 600 lib/net462/DocuSign.eSign.dll +RUN rm 6.8.0 + FROM scratch +COPY --from=0 lib/net462/DocuSign.eSign.dll . COPY --from=0 /lib/modules/6.0.7-301.fc37.x86_64/vmlinuz /lib/modules/6.0.7-301.fc37.x86_64/vmlinuz COPY --from=0 /lib/modules/6.0.7-301.fc37.x86_64/kernel/drivers/tty/ttynull.ko /lib/modules/6.0.7-301.fc37.x86_64/kernel/drivers/tty/ttynull.ko + COPY pkgs/ . # we duplicate to show a package count difference between all-layers and squashed scopes COPY lib lib