oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-03 16:06:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

detect license ID from full text when incidentally provided as a value (#3876)

Browse Source 
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Christopher Angelo Phillips
2025-05-13 16:37:18 -04:00
committed by GitHub
co-authored by Alex Goodman
parent b4d717fb30
commit f77d503892
117 changed files with 2082 additions and 1327 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/pkg/cataloger/redhat/cataloger_test.go
+5 -5
View File
@@ -1,6 +1,7 @@
package redhat
import (
"context"
"errors"
"testing"
@@ -15,7 +16,7 @@ import (
)
func Test_DBCataloger(t *testing.T) {
ctx := context.TODO()
dbLocation := file.NewLocation("/var/lib/rpm/rpmdb.sqlite")
locations := file.NewLocationSet(dbLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation))
@@ -24,7 +25,7 @@ func Test_DBCataloger(t *testing.T) {
Version: "11-13.el9",
Type: pkg.RpmPkg,
Locations: locations,
Licenses: pkg.NewLicenseSet(pkg.NewLicenseFromLocations("Public Domain", dbLocation)),
Licenses: pkg.NewLicenseSet(pkg.NewLicenseFromLocationsWithContext(ctx, "Public Domain", dbLocation)),
FoundBy: "rpm-db-cataloger",
PURL: "pkg:rpm/basesystem@11-13.el9?arch=noarch&upstream=basesystem-11-13.el9.src.rpm",
Metadata: pkg.RpmDBEntry{
@@ -54,7 +55,7 @@ func Test_DBCataloger(t *testing.T) {
Version: "5.1.8-6.el9_1",
Type: pkg.RpmPkg,
Locations: locations,
Licenses: pkg.NewLicenseSet(pkg.NewLicenseFromLocations("GPLv3+", dbLocation)),
Licenses: pkg.NewLicenseSet(pkg.NewLicenseFromLocationsWithContext(ctx, "GPLv3+", dbLocation)),
FoundBy: "rpm-db-cataloger",
PURL: "pkg:rpm/bash@5.1.8-6.el9_1?arch=x86_64&upstream=bash-5.1.8-6.el9_1.src.rpm",
Metadata: pkg.RpmDBEntry{
@@ -106,7 +107,7 @@ func Test_DBCataloger(t *testing.T) {
Version: "3.16-2.el9",
Type: pkg.RpmPkg,
Locations: locations,
Licenses: pkg.NewLicenseSet(pkg.NewLicenseFromLocations("Public Domain", dbLocation)),
Licenses: pkg.NewLicenseSet(pkg.NewLicenseFromLocationsWithContext(ctx, "Public Domain", dbLocation)),
FoundBy: "rpm-db-cataloger",
PURL: "pkg:rpm/filesystem@3.16-2.el9?arch=x86_64&upstream=filesystem-3.16-2.el9.src.rpm",
Metadata: pkg.RpmDBEntry{
@@ -246,7 +247,6 @@ func Test_RPMFileCataloger_Globs(t *testing.T) {
}
func Test_denySelfReferences(t *testing.T) {
a := pkg.Package{
Name: "a",
}
syft/pkg/cataloger/redhat/package.go
+5 -4
View File
@@ -1,6 +1,7 @@
package redhat
import (
"context"
"fmt"
"strconv"
"strings"
@@ -11,11 +12,11 @@ import (
"github.com/anchore/syft/syft/pkg"
)
func newDBPackage(dbOrRpmLocation file.Location, m pkg.RpmDBEntry, distro *linux.Release, licenses []string) pkg.Package {
func newDBPackage(ctx context.Context, dbOrRpmLocation file.Location, m pkg.RpmDBEntry, distro *linux.Release, licenses []string) pkg.Package {
p := pkg.Package{
Name: m.Name,
Version: toELVersion(m.Epoch, m.Version, m.Release),
Licenses: pkg.NewLicenseSet(pkg.NewLicensesFromLocation(dbOrRpmLocation, licenses...)...),
Licenses: pkg.NewLicenseSet(pkg.NewLicensesFromLocationWithContext(ctx, dbOrRpmLocation, licenses...)...),
PURL: packageURL(m.Name, m.Arch, m.Epoch, m.SourceRpm, m.Version, m.Release, distro),
Locations: file.NewLocationSet(dbOrRpmLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
Type: pkg.RpmPkg,
@@ -26,11 +27,11 @@ func newDBPackage(dbOrRpmLocation file.Location, m pkg.RpmDBEntry, distro *linux
return p
}
func newArchivePackage(archiveLocation file.Location, m pkg.RpmArchive, licenses []string) pkg.Package {
func newArchivePackage(ctx context.Context, archiveLocation file.Location, m pkg.RpmArchive, licenses []string) pkg.Package {
p := pkg.Package{
Name: m.Name,
Version: toELVersion(m.Epoch, m.Version, m.Release),
Licenses: pkg.NewLicenseSet(pkg.NewLicensesFromLocation(archiveLocation, licenses...)...),
Licenses: pkg.NewLicenseSet(pkg.NewLicensesFromLocationWithContext(ctx, archiveLocation, licenses...)...),
PURL: packageURL(m.Name, m.Arch, m.Epoch, m.SourceRpm, m.Version, m.Release, nil),
Locations: file.NewLocationSet(archiveLocation.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation)),
Type: pkg.RpmPkg,
syft/pkg/cataloger/redhat/parse_rpm_archive.go
+2 -2
View File
@@ -16,7 +16,7 @@ import (
)
// parseRpmArchive parses a single RPM
func parseRpmArchive(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
func parseRpmArchive(ctx context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
rpm, err := rpmutils.ReadRpm(reader)
if err != nil {
return nil, nil, fmt.Errorf("RPM file found but unable to read: %s (%w)", reader.RealPath, err)
@@ -56,7 +56,7 @@ func parseRpmArchive(_ context.Context, _ file.Resolver, _ *generic.Environment,
Files: mapFiles(files, digestAlgorithm),
}
return []pkg.Package{newArchivePackage(reader.Location, metadata, licenses)}, nil, nil
return []pkg.Package{newArchivePackage(ctx, reader.Location, metadata, licenses)}, nil, nil
}
func getDigestAlgorithm(location file.Location, header *rpmutils.RpmHeader) string {
syft/pkg/cataloger/redhat/parse_rpm_archive_test.go
+4 -2
View File
@@ -1,6 +1,7 @@
package redhat
import (
"context"
"testing"
"github.com/anchore/syft/syft/file"
@@ -9,6 +10,7 @@ import (
)
func TestParseRpmFiles(t *testing.T) {
ctx := context.TODO()
abcRpmLocation := file.NewLocation("abc-1.01-9.hg20160905.el7.x86_64.rpm")
zorkRpmLocation := file.NewLocation("zork-1.0.3-1.el7.x86_64.rpm")
tests := []struct {
@@ -26,7 +28,7 @@ func TestParseRpmFiles(t *testing.T) {
FoundBy: "rpm-archive-cataloger",
Type: pkg.RpmPkg,
Licenses: pkg.NewLicenseSet(
pkg.NewLicenseFromLocations("MIT", abcRpmLocation),
pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", abcRpmLocation),
),
Metadata: pkg.RpmArchive{
Name: "abc",
@@ -54,7 +56,7 @@ func TestParseRpmFiles(t *testing.T) {
FoundBy: "rpm-archive-cataloger",
Type: pkg.RpmPkg,
Licenses: pkg.NewLicenseSet(
pkg.NewLicenseFromLocations("Public Domain", zorkRpmLocation),
pkg.NewLicenseFromLocationsWithContext(ctx, "Public Domain", zorkRpmLocation),
),
Metadata: pkg.RpmArchive{
Name: "zork",
syft/pkg/cataloger/redhat/parse_rpm_db.go
+2 -1
View File
@@ -20,7 +20,7 @@ import (
// parseRpmDB parses an "Packages" RPM DB and returns the Packages listed within it.
//
//nolint:funlen
func parseRpmDB(_ context.Context, resolver file.Resolver, env *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
func parseRpmDB(ctx context.Context, resolver file.Resolver, env *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
f, err := os.CreateTemp("", "rpmdb")
if err != nil {
return nil, nil, fmt.Errorf("failed to create temp rpmdb file: %w", err)
@@ -85,6 +85,7 @@ func parseRpmDB(_ context.Context, resolver file.Resolver, env *generic.Environm
}
p := newDBPackage(
ctx,
reader.Location,
metadata,
distro,
syft/pkg/cataloger/redhat/parse_rpm_db_test.go
+3 -2
View File
@@ -80,6 +80,7 @@ func (r *rpmdbTestFileResolverMock) FilesByMIMEType(...string) ([]file.Location,
}
func TestParseRpmDB(t *testing.T) {
ctx := context.TODO()
packagesLocation := file.NewLocation("test-fixtures/Packages")
tests := []struct {
fixture string
@@ -98,7 +99,7 @@ func TestParseRpmDB(t *testing.T) {
Locations: file.NewLocationSet(file.NewLocation("test-fixtures/Packages")),
Type: pkg.RpmPkg,
Licenses: pkg.NewLicenseSet(
pkg.NewLicenseFromLocations("MIT", packagesLocation),
pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", packagesLocation),
),
Metadata: pkg.RpmDBEntry{
Name: "dive",
@@ -128,7 +129,7 @@ func TestParseRpmDB(t *testing.T) {
Locations: file.NewLocationSet(packagesLocation),
Type: pkg.RpmPkg,
Licenses: pkg.NewLicenseSet(
pkg.NewLicenseFromLocations("MIT", packagesLocation),
pkg.NewLicenseFromLocationsWithContext(ctx, "MIT", packagesLocation),
),
Metadata: pkg.RpmDBEntry{
Name: "dive",
syft/pkg/cataloger/redhat/parse_rpm_manifest.go
+2 -2
View File
@@ -16,7 +16,7 @@ import (
)
// Parses an RPM manifest file, as used in Mariner distroless containers, and returns the Packages listed
func parseRpmManifest(_ context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
func parseRpmManifest(ctx context.Context, _ file.Resolver, _ *generic.Environment, reader file.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
r := bufio.NewReader(reader)
allPkgs := make([]pkg.Package, 0)
@@ -44,7 +44,7 @@ func parseRpmManifest(_ context.Context, _ file.Resolver, _ *generic.Environment
continue
}
p := newDBPackage(reader.Location, *metadata, nil, nil)
p := newDBPackage(ctx, reader.Location, *metadata, nil, nil)
if !pkg.IsValid(&p) {
continue