From fa599547a3d94e5076bd6fecb3ae0a07a6b718fe Mon Sep 17 00:00:00 2001
From: VictorHuu <victorhu493@gmail.com>
Date: Fri, 25 Apr 2025 23:50:45 +0800
Subject: [PATCH] fix the fluent-bit regex detection pattern (#3817)

Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
---
 .../cataloger/binary/classifier_cataloger_test.go |  11 +++++++++++
 syft/pkg/cataloger/binary/classifiers.go          |   3 ++-
 .../fluent-bit/1.3.10/linux-arm/fluent-bit        | Bin 0 -> 354 bytes
 .../cataloger/binary/test-fixtures/config.yaml    |   7 +++++++
 4 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/fluent-bit/1.3.10/linux-arm/fluent-bit

diff --git a/syft/pkg/cataloger/binary/classifier_cataloger_test.go b/syft/pkg/cataloger/binary/classifier_cataloger_test.go
index ec0ecf12a..341c7da7a 100644
--- a/syft/pkg/cataloger/binary/classifier_cataloger_test.go
+++ b/syft/pkg/cataloger/binary/classifier_cataloger_test.go
@@ -1243,6 +1243,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("fluent-bit-binary"),
 			},
 		},
+		{
+			logicalFixture: "fluent-bit/1.3.10/linux-arm",
+			expected: pkg.Package{
+				Name:      "fluent-bit",
+				Version:   "1.3.10",
+				Type:      "binary",
+				PURL:      "pkg:github/fluent/fluent-bit@1.3.10",
+				Locations: locations("fluent-bit"),
+				Metadata:  metadata("fluent-bit-binary"),
+			},
+		},
 		{
 			logicalFixture: "wp/2.9.0/linux-amd64",
 			expected: pkg.Package{
diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go
index 558d613c5..1dabf7a5a 100644
--- a/syft/pkg/cataloger/binary/classifiers.go
+++ b/syft/pkg/cataloger/binary/classifiers.go
@@ -573,7 +573,8 @@ func DefaultClassifiers() []Classifier {
 				// [NUL]2.2.3[NUL]Fluent Bit
 				// [NUL]2.2.1[NUL][NUL][NUL]Fluent Bit
 				// [NUL]1.7.0[NUL]\x1b[1m[NUL]%sFluent Bit (versions 1.7.0-dev-3 through 1.7.0-dev-9 and 1.7.0-rc4 through 1.7.0-rc8)
-				`\x00(?P<version>[0-9]+\.[0-9]+\.[0-9]+)\x00(\x1b\[1m\x00|\x00\x00)?(%s)?Fluent`,
+				// [NUL][NUL]1.3.10[NUL][NUL]Fluent Bit v%s
+				`\x00(\x00)?(?P<version>[0-9]+\.[0-9]+\.[0-9]+)\x00(\x1b\[1m\x00|\x00|\x00\x00)?(%s)?Fluent`,
 			),
 			Package: "fluent-bit",
 			PURL:    mustPURL("pkg:github/fluent/fluent-bit@version"),
diff --git a/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/fluent-bit/1.3.10/linux-arm/fluent-bit b/syft/pkg/cataloger/binary/test-fixtures/classifiers/snippets/fluent-bit/1.3.10/linux-arm/fluent-bit
new file mode 100644
index 0000000000000000000000000000000000000000..9330e7e5df16ea26d86330a0a0533b026441edcd
GIT binary patch
literal 354
zcmY+9J8!~J42AD}{{qXE5K<Y6?)#CkRIRd9s(^{fNo<G|5=1Vo`1cKc4Bd{uV;|c+
zoUjnoU9r!PRh#)hG-57<F($cac!&KV9}A(h<YV8S&zLty(9Rda`&u>Rf(_^}*#r~}
zS<pcSAlp<PU2Kr5L{6(DHCd}0iH4$%vQagsw!^=$;Ea~4l3<a*fec#Ns45>-O2O6%
zCYXY+!8g;i^VV8)HK3aI#RQJ?`Ft*_TSoDFrpSY!q3ecEF<G23wK6Lu8GHHuRy?&?
zd@M%J7UO?%XS2OJ&GyNh7@Pd{aK2sI!!e78^-^pv2;=pF;u$hb%~Lenl&|I6c6pa~
L{k|)IicR?iSjb@*

literal 0
HcmV?d00001

diff --git a/syft/pkg/cataloger/binary/test-fixtures/config.yaml b/syft/pkg/cataloger/binary/test-fixtures/config.yaml
index b4a3bcc71..8cf217360 100644
--- a/syft/pkg/cataloger/binary/test-fixtures/config.yaml
+++ b/syft/pkg/cataloger/binary/test-fixtures/config.yaml
@@ -701,6 +701,13 @@ from-images:
     paths:
       - /fluent-bit/bin/fluent-bit
 
+  - version: 1.3.10
+    images:
+      - ref: fluent/fluent-bit:1.3.10@sha256:98b32ef90c3ee3f6981b2cf31b70dc7d6104c9800b7287d4758318e0c19f96a9
+        platform: linux/arm
+    paths:
+      - /fluent-bit/bin/fluent-bit
+
   - name: openssl
     version: 1.1.1w
     images: