mirror of
https://github.com/anchore/syft.git
synced 2026-10-29 13:32:27 +01:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Christopher Angelo Phillips
|
4ac8fdf6df | ||
 Idan Frimark
|
087a6356b9 | ||
  Alex GoodmanandWeston Steimel
|
26c201f7f7 | ||
 Keith Zantow
|
a3c5550217 | ||
  anchore-actions-token-generator[bot]andkzantow
|
798af57853 | ||
 dependabot[bot]
|
f50302b2ba | ||
|
dependabot[bot]
|
b09cf6c6b5 |
@@ -36,7 +36,7 @@ require (
|
||||
github.com/spf13/cobra v1.7.0
|
||||
github.com/spf13/pflag v1.0.5
|
||||
github.com/spf13/viper v1.15.0
|
||||
github.com/stretchr/testify v1.8.2
|
||||
github.com/stretchr/testify v1.8.3
|
||||
github.com/vifraa/gopom v0.2.1
|
||||
github.com/wagoodman/go-partybus v0.0.0-20210627031916-db1f5573bbc5
|
||||
github.com/wagoodman/go-progress v0.0.0-20230301185719-21920a456ad5
|
||||
@@ -53,9 +53,9 @@ require (
|
||||
github.com/Masterminds/semver v1.5.0
|
||||
github.com/Masterminds/sprig/v3 v3.2.3
|
||||
github.com/anchore/go-logger v0.0.0-20220728155337-03b66a5207d8
|
||||
github.com/anchore/stereoscope v0.0.0-20230508133058-5543439b749f
|
||||
github.com/anchore/stereoscope v0.0.0-20230522170632-e14bc4437b2e
|
||||
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
|
||||
github.com/docker/docker v24.0.0+incompatible
|
||||
github.com/docker/docker v24.0.1+incompatible
|
||||
github.com/github/go-spdx/v2 v2.1.2
|
||||
github.com/go-git/go-billy/v5 v5.4.1
|
||||
github.com/go-git/go-git/v5 v5.6.1
|
||||
@@ -86,7 +86,7 @@ require (
|
||||
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/docker/cli v23.0.5+incompatible // indirect
|
||||
github.com/docker/distribution v2.8.1+incompatible // indirect
|
||||
github.com/docker/distribution v2.8.2+incompatible // indirect
|
||||
github.com/docker/docker-credential-helpers v0.7.0 // indirect
|
||||
github.com/docker/go-connections v0.4.0 // indirect
|
||||
github.com/docker/go-units v0.5.0 // indirect
|
||||
|
||||
@@ -98,8 +98,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b h1:e1bmaoJfZV
|
||||
github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
|
||||
github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501 h1:AV7qjwMcM4r8wFhJq3jLRztew3ywIyPTRapl2T1s9o8=
|
||||
github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
|
||||
github.com/anchore/stereoscope v0.0.0-20230508133058-5543439b749f h1:wiWDirrn2a4gT2TfFeGb5zqFjKoEy3Hx+K8u8lReHzY=
|
||||
github.com/anchore/stereoscope v0.0.0-20230508133058-5543439b749f/go.mod h1:2GGFHkHry/xDlEQgBrVGcarq+z7Z6hLnHdyhcKB2lfQ=
|
||||
github.com/anchore/stereoscope v0.0.0-20230522170632-e14bc4437b2e h1:YPWJxds1hKRedS92u7O6D6ULVOx1F2HGgS4CWqJdBYw=
|
||||
github.com/anchore/stereoscope v0.0.0-20230522170632-e14bc4437b2e/go.mod h1:0LsgHgXO4QFnk2hsYwtqd3fR18PIZXlFLIl2qb9tu3g=
|
||||
github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
|
||||
github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
|
||||
github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
|
||||
@@ -164,10 +164,10 @@ github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da/go.mod h1:B3tI9iGHi4i
|
||||
github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
|
||||
github.com/docker/cli v23.0.5+incompatible h1:ufWmAOuD3Vmr7JP2G5K3cyuNC4YZWiAsuDEvFVVDafE=
|
||||
github.com/docker/cli v23.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
|
||||
github.com/docker/distribution v2.8.1+incompatible h1:Q50tZOPR6T/hjNsyc9g8/syEs6bk8XXApsHjKukMl68=
|
||||
github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
|
||||
github.com/docker/docker v24.0.0+incompatible h1:z4bf8HvONXX9Tde5lGBMQ7yCJgNahmJumdrStZAbeY4=
|
||||
github.com/docker/docker v24.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||
github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
|
||||
github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
|
||||
github.com/docker/docker v24.0.1+incompatible h1:NxN81beIxDlUaVt46iUQrYHD9/W3u9EGl52r86O/IGw=
|
||||
github.com/docker/docker v24.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||
github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
|
||||
github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
|
||||
github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
|
||||
@@ -598,8 +598,9 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
|
||||
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||
github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
|
||||
github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||
github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY=
|
||||
github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
|
||||
github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
|
||||
github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
|
||||
github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
|
||||
|
||||
+13
-3
@@ -3,6 +3,7 @@ package license
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"runtime/debug"
|
||||
|
||||
"github.com/github/go-spdx/v2/spdxexp"
|
||||
|
||||
@@ -16,19 +17,28 @@ const (
|
||||
Concluded Type = "concluded"
|
||||
)
|
||||
|
||||
func ParseExpression(expression string) (string, error) {
|
||||
func ParseExpression(expression string) (ex string, err error) {
|
||||
// https://github.com/anchore/syft/issues/1837
|
||||
// The current spdx library can panic when parsing some expressions
|
||||
// This is a temporary fix to recover and patch until we can investigate and contribute
|
||||
// a fix to the upstream github library
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
err = fmt.Errorf("recovered from panic while parsing license expression at: \n%s", string(debug.Stack()))
|
||||
}
|
||||
}()
|
||||
|
||||
licenseID, exists := spdxlicense.ID(expression)
|
||||
if exists {
|
||||
return licenseID, nil
|
||||
}
|
||||
|
||||
// If it doesn't exist initially in the SPDX list it might be a more complex expression
|
||||
// ignored variable is any invalid expressions
|
||||
// TODO: contribute to spdxexp to expose deprecated license IDs
|
||||
// https://github.com/anchore/syft/issues/1814
|
||||
valid, _ := spdxexp.ValidateLicenses([]string{expression})
|
||||
if !valid {
|
||||
return "", fmt.Errorf("failed to validate spdx expression: %s", expression)
|
||||
return "", fmt.Errorf("invalid SPDX expression: %s", expression)
|
||||
}
|
||||
|
||||
return expression, nil
|
||||
|
||||
@@ -239,30 +239,6 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("redis-binary"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-argocd-2.5.11",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/argocd-2.5.11",
|
||||
expected: pkg.Package{
|
||||
Name: "argocd",
|
||||
Version: "2.5.11",
|
||||
Type: "binary",
|
||||
PURL: "pkg:golang/github.com/argoproj/argo-cd@2.5.11",
|
||||
Locations: locations("argocd"),
|
||||
Metadata: metadata("argocd"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-argocd-2.6.4",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/argocd-2.6.4",
|
||||
expected: pkg.Package{
|
||||
Name: "argocd",
|
||||
Version: "2.6.4",
|
||||
Type: "binary",
|
||||
PURL: "pkg:golang/github.com/argoproj/argo-cd@2.6.4",
|
||||
Locations: locations("argocd"),
|
||||
Metadata: metadata("argocd"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-helm-3.11.1",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/helm-3.11.1",
|
||||
@@ -287,66 +263,6 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases(t *testing.T) {
|
||||
Metadata: metadata("helm"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-kubectl-1.24.11",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/kubectl-1.24.11",
|
||||
expected: pkg.Package{
|
||||
Name: "kubectl",
|
||||
Version: "1.24.11",
|
||||
Type: "binary",
|
||||
PURL: "pkg:golang/k8s.io/kubectl@1.24.11",
|
||||
Locations: locations("kubectl"),
|
||||
Metadata: metadata("kubectl"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-kubectl-1.25.7",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/kubectl-1.25.7",
|
||||
expected: pkg.Package{
|
||||
Name: "kubectl",
|
||||
Version: "1.25.7",
|
||||
Type: "binary",
|
||||
PURL: "pkg:golang/k8s.io/kubectl@1.25.7",
|
||||
Locations: locations("kubectl"),
|
||||
Metadata: metadata("kubectl"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-kubectl-1.26.2",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/kubectl-1.26.2",
|
||||
expected: pkg.Package{
|
||||
Name: "kubectl",
|
||||
Version: "1.26.2",
|
||||
Type: "binary",
|
||||
PURL: "pkg:golang/k8s.io/kubectl@1.26.2",
|
||||
Locations: locations("kubectl"),
|
||||
Metadata: metadata("kubectl"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-kustomize-4.5.7",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/kustomize-4.5.7",
|
||||
expected: pkg.Package{
|
||||
Name: "kustomize",
|
||||
Version: "4.5.7",
|
||||
Type: "binary",
|
||||
PURL: "pkg:golang/sigs.k8s.io/kustomize@4.5.7",
|
||||
Locations: locations("kustomize"),
|
||||
Metadata: metadata("kustomize"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-kustomize-5.0.0",
|
||||
fixtureDir: "test-fixtures/classifiers/dynamic/kustomize-5.0.0",
|
||||
expected: pkg.Package{
|
||||
Name: "kustomize",
|
||||
Version: "5.0.0",
|
||||
Type: "binary",
|
||||
PURL: "pkg:golang/sigs.k8s.io/kustomize@5.0.0",
|
||||
Locations: locations("kustomize"),
|
||||
Metadata: metadata("kustomize"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "positive-redis-4.0.11",
|
||||
fixtureDir: "test-fixtures/classifiers/positive/redis-server-4.0.11",
|
||||
|
||||
@@ -46,15 +46,6 @@ var defaultClassifiers = []classifier{
|
||||
PURL: mustPURL("pkg:generic/go@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"),
|
||||
},
|
||||
{
|
||||
Class: "argocd",
|
||||
FileGlob: "**/argocd",
|
||||
EvidenceMatcher: fileContentsVersionMatcher(
|
||||
`(?m)common\.version=(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
|
||||
Package: "argocd",
|
||||
PURL: mustPURL("pkg:golang/github.com/argoproj/argo-cd@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:argoproj:argocd:*:*:*:*:*:*:*"),
|
||||
},
|
||||
{
|
||||
Class: "helm",
|
||||
FileGlob: "**/helm",
|
||||
@@ -64,24 +55,6 @@ var defaultClassifiers = []classifier{
|
||||
PURL: mustPURL("pkg:golang/helm.sh/helm@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:helm:helm:*:*:*:*:*:*:*"),
|
||||
},
|
||||
{
|
||||
Class: "kustomize",
|
||||
FileGlob: "**/kustomize",
|
||||
EvidenceMatcher: fileContentsVersionMatcher(
|
||||
`(?m)version=kustomize/v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)`),
|
||||
Package: "kustomize",
|
||||
PURL: mustPURL("pkg:golang/sigs.k8s.io/kustomize@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:kustomize:kustomize:*:*:*:*:*:*:*"),
|
||||
},
|
||||
{
|
||||
Class: "kubectl",
|
||||
FileGlob: "**/kubectl",
|
||||
EvidenceMatcher: fileContentsVersionMatcher(
|
||||
`(?m)\x00v(?P<version>[0-9]+\.[0-9]+\.[0-9]+)\x00`),
|
||||
Package: "kubectl",
|
||||
PURL: mustPURL("pkg:golang/k8s.io/kubectl@version"),
|
||||
CPEs: singleCPE("cpe:2.3:a:kubectl:kubectl:*:*:*:*:*:*:*"),
|
||||
},
|
||||
{
|
||||
Class: "redis-binary",
|
||||
FileGlob: "**/redis-server",
|
||||
|
||||
@@ -7,15 +7,8 @@ all: \
|
||||
classifiers/dynamic/ruby-library-3.2.1 \
|
||||
classifiers/dynamic/ruby-library-2.7.7 \
|
||||
classifiers/dynamic/ruby-library-2.6.10 \
|
||||
classifiers/dynamic/argocd-2.5.11 \
|
||||
classifiers/dynamic/argocd-2.6.4 \
|
||||
classifiers/dynamic/helm-3.11.1 \
|
||||
classifiers/dynamic/helm-3.10.3 \
|
||||
classifiers/dynamic/kubectl-1.24.11 \
|
||||
classifiers/dynamic/kubectl-1.25.7 \
|
||||
classifiers/dynamic/kubectl-1.26.2 \
|
||||
classifiers/dynamic/kustomize-4.5.7 \
|
||||
classifiers/dynamic/kustomize-5.0.0 \
|
||||
classifiers/dynamic/consul-1.15.2
|
||||
|
||||
|
||||
@@ -89,18 +82,6 @@ classifiers/dynamic/ruby-library-2.6.10:
|
||||
/usr/local/lib/libruby.so.2.6 \
|
||||
$@/libruby.so.2.6
|
||||
|
||||
classifiers/dynamic/argocd-2.5.11:
|
||||
$(eval $@_image := "argoproj/argocd:v2.5.11@sha256:d1062935b3256ec69422843ebcb50debb54fd389436961586000c8ce6ee7f249")
|
||||
./get-image-file.sh $($@_image) \
|
||||
/usr/local/bin/argocd \
|
||||
$@/argocd
|
||||
|
||||
classifiers/dynamic/argocd-2.6.4:
|
||||
$(eval $@_image := "argoproj/argocd:v2.6.4@sha256:61fcbba187ff53c00696cb580edf70cada59c45cf399d8477631acf43cf522ee")
|
||||
./get-image-file.sh $($@_image) \
|
||||
/usr/local/bin/argocd \
|
||||
$@/argocd
|
||||
|
||||
classifiers/dynamic/helm-3.11.1:
|
||||
$(eval $@_image := "alpine/helm:3.11.1@sha256:8628e3695fb743a8b9de89626f1b7a221280c2152c0e288c2504e59b68233e8b")
|
||||
./get-image-file.sh $($@_image) \
|
||||
@@ -113,36 +94,6 @@ classifiers/dynamic/helm-3.10.3:
|
||||
/usr/local/bin/helm \
|
||||
$@/helm
|
||||
|
||||
classifiers/dynamic/kubectl-1.24.11:
|
||||
$(eval $@_image := "bitnami/kubectl:1.24.11@sha256:79d60c5ac8a1dc84e2c39f56d8e8cc0053159b5ed88f283bdf8fbda1ee86c8bc")
|
||||
./get-image-file.sh $($@_image) \
|
||||
/opt/bitnami/kubectl/bin/kubectl \
|
||||
$@/kubectl
|
||||
|
||||
classifiers/dynamic/kubectl-1.25.7:
|
||||
$(eval $@_image := "bitnami/kubectl:1.25.7@sha256:d7b00dbfdc6d8890aefe40edfb6c1d4c90cbb6c978794bb51a21744edc34ba7a")
|
||||
./get-image-file.sh $($@_image) \
|
||||
/opt/bitnami/kubectl/bin/kubectl \
|
||||
$@/kubectl
|
||||
|
||||
classifiers/dynamic/kubectl-1.26.2:
|
||||
$(eval $@_image := "line/kubectl-kustomize:1.26.2-5.0.0@sha256:9ee3b4a9a21f0777fc1d8c64208290f818a2e68c5e9e892e931621bda089bf06")
|
||||
./get-image-file.sh $($@_image) \
|
||||
/usr/local/bin/kubectl \
|
||||
$@/kubectl
|
||||
|
||||
classifiers/dynamic/kustomize-4.5.7:
|
||||
$(eval $@_image := "argoproj/argocd:v2.6.4@sha256:61fcbba187ff53c00696cb580edf70cada59c45cf399d8477631acf43cf522ee")
|
||||
./get-image-file.sh $($@_image) \
|
||||
/usr/local/bin/kustomize \
|
||||
$@/kustomize
|
||||
|
||||
classifiers/dynamic/kustomize-5.0.0:
|
||||
$(eval $@_image := "line/kubectl-kustomize:1.26.2-5.0.0@sha256:9ee3b4a9a21f0777fc1d8c64208290f818a2e68c5e9e892e931621bda089bf06")
|
||||
./get-image-file.sh $($@_image) \
|
||||
/usr/local/bin/kustomize \
|
||||
$@/kustomize
|
||||
|
||||
classifiers/dynamic/consul-1.15.2:
|
||||
$(eval $@_image := "hashicorp/consul:1.15.2@sha256:c2169f3bb18dd947ae8eb5f6766896695c71fb439f050a3343e0007d895615b8")
|
||||
./get-image-file.sh $($@_image) \
|
||||
|
||||
@@ -18,7 +18,7 @@ func (c *goBinaryCataloger) newGoBinaryPackage(resolver source.FileResolver, dep
|
||||
|
||||
licenses, err := c.licenses.getLicenses(resolver, dep.Path, dep.Version)
|
||||
if err != nil {
|
||||
log.Tracef("error getting licenses for package: %s %v", dep.Path, err)
|
||||
log.Tracef("error getting licenses for golang package: %s %v", dep.Path, err)
|
||||
}
|
||||
|
||||
p := pkg.Package{
|
||||
|
||||
@@ -8,6 +8,7 @@ import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"regexp"
|
||||
"runtime/debug"
|
||||
"strings"
|
||||
"time"
|
||||
@@ -34,6 +35,11 @@ var (
|
||||
// devel is used to recognize the current default version when a golang main distribution is built
|
||||
// https://github.com/golang/go/issues/29228 this issue has more details on the progress of being able to
|
||||
// inject the correct version into the main module of the build process
|
||||
|
||||
knownBuildFlagPatterns = []*regexp.Regexp{
|
||||
regexp.MustCompile(`(?m)\.([gG]it)?([bB]uild)?[vV]ersion=(\S+/)*(?P<version>v?\d+.\d+.\d+[-\w]*)`),
|
||||
regexp.MustCompile(`(?m)\.([tT]ag)=(\S+/)*(?P<version>v?\d+.\d+.\d+[-\w]*)`),
|
||||
}
|
||||
)
|
||||
|
||||
const devel = "(devel)"
|
||||
@@ -71,27 +77,82 @@ func (c *goBinaryCataloger) makeGoMainPackage(resolver source.FileResolver, mod
|
||||
gbs,
|
||||
location.WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
|
||||
)
|
||||
if main.Version == devel {
|
||||
if version, ok := gbs["vcs.revision"]; ok {
|
||||
if timestamp, ok := gbs["vcs.time"]; ok {
|
||||
//NOTE: err is ignored, because if parsing fails
|
||||
// we still use the empty Time{} struct to generate an empty date, like 00010101000000
|
||||
// for consistency with the pseudo-version format: https://go.dev/ref/mod#pseudo-versions
|
||||
ts, _ := time.Parse(time.RFC3339, timestamp)
|
||||
if len(version) >= 12 {
|
||||
version = version[:12]
|
||||
}
|
||||
version = module.PseudoVersion("", "", ts, version)
|
||||
|
||||
if main.Version != devel {
|
||||
return main
|
||||
}
|
||||
|
||||
version, hasVersion := gbs["vcs.revision"]
|
||||
timestamp, hasTimestamp := gbs["vcs.time"]
|
||||
|
||||
if hasVersion {
|
||||
if hasTimestamp {
|
||||
//NOTE: err is ignored, because if parsing fails
|
||||
// we still use the empty Time{} struct to generate an empty date, like 00010101000000
|
||||
// for consistency with the pseudo-version format: https://go.dev/ref/mod#pseudo-versions
|
||||
ts, _ := time.Parse(time.RFC3339, timestamp)
|
||||
if len(version) >= 12 {
|
||||
version = version[:12]
|
||||
}
|
||||
|
||||
var ldflags string
|
||||
if metadata, ok := main.Metadata.(pkg.GolangBinMetadata); ok {
|
||||
ldflags = metadata.BuildSettings["-ldflags"]
|
||||
}
|
||||
|
||||
majorVersion, fullVersion := extractVersionFromLDFlags(ldflags)
|
||||
if fullVersion != "" {
|
||||
// we've found a specific version from the ldflags! use it as the version.
|
||||
// why not combine that with the pseudo version (e.g. v1.2.3-0.20210101000000-abcdef123456)?
|
||||
// short answer: we're assuming that if a specific semver was provided in the ldflags that
|
||||
// there is a matching vcs tag to match that could be referenced. This assumption could
|
||||
// be incorrect in terms of the go.mod contents, but is not incorrect in terms of the logical
|
||||
// version of the package.
|
||||
version = fullVersion
|
||||
} else {
|
||||
version = module.PseudoVersion(majorVersion, fullVersion, ts, version)
|
||||
}
|
||||
main.Version = version
|
||||
main.PURL = packageURL(main.Name, main.Version)
|
||||
main.SetID()
|
||||
}
|
||||
|
||||
main.Version = version
|
||||
main.PURL = packageURL(main.Name, main.Version)
|
||||
|
||||
main.SetID()
|
||||
}
|
||||
|
||||
return main
|
||||
}
|
||||
|
||||
func extractVersionFromLDFlags(ldflags string) (majorVersion string, fullVersion string) {
|
||||
if ldflags == "" {
|
||||
return "", ""
|
||||
}
|
||||
|
||||
for _, pattern := range knownBuildFlagPatterns {
|
||||
groups := internal.MatchNamedCaptureGroups(pattern, ldflags)
|
||||
v, ok := groups["version"]
|
||||
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
|
||||
fullVersion = v
|
||||
if !strings.HasPrefix(v, "v") {
|
||||
fullVersion = fmt.Sprintf("v%s", v)
|
||||
}
|
||||
components := strings.Split(v, ".")
|
||||
|
||||
if len(components) == 0 {
|
||||
continue
|
||||
}
|
||||
|
||||
majorVersion = strings.TrimPrefix(components[0], "v")
|
||||
return majorVersion, fullVersion
|
||||
}
|
||||
|
||||
return "", ""
|
||||
}
|
||||
|
||||
// getArchs finds a binary architecture by two ways:
|
||||
// 1) reading build info from binaries compiled by go1.18+
|
||||
// 2) reading file headers from binaries compiled by < go1.18
|
||||
|
||||
@@ -299,7 +299,101 @@ func TestBuildGoPkgInfo(t *testing.T) {
|
||||
expected: []pkg.Package{unmodifiedMain},
|
||||
},
|
||||
{
|
||||
name: "parse main mod and replace devel version",
|
||||
name: "parse main mod and replace devel pseudo version and ldflags exists (but contains no version)",
|
||||
arch: archDetails,
|
||||
mod: &debug.BuildInfo{
|
||||
GoVersion: goCompiledVersion,
|
||||
Main: debug.Module{Path: "github.com/anchore/syft", Version: "(devel)"},
|
||||
Settings: []debug.BuildSetting{
|
||||
{Key: "GOARCH", Value: archDetails},
|
||||
{Key: "GOOS", Value: "darwin"},
|
||||
{Key: "GOAMD64", Value: "v1"},
|
||||
{Key: "vcs.revision", Value: "41bc6bb410352845f22766e27dd48ba93aa825a4"},
|
||||
{Key: "vcs.time", Value: "2022-10-14T19:54:57Z"},
|
||||
{Key: "-ldflags", Value: `build -ldflags="-w -s -extldflags '-static' -X blah=foobar`},
|
||||
},
|
||||
},
|
||||
expected: []pkg.Package{
|
||||
{
|
||||
Name: "github.com/anchore/syft",
|
||||
Language: pkg.Go,
|
||||
Type: pkg.GoModulePkg,
|
||||
Version: "v0.0.0-20221014195457-41bc6bb41035",
|
||||
PURL: "pkg:golang/github.com/anchore/syft@v0.0.0-20221014195457-41bc6bb41035",
|
||||
Locations: source.NewLocationSet(
|
||||
source.NewLocationFromCoordinates(
|
||||
source.Coordinates{
|
||||
RealPath: "/a-path",
|
||||
FileSystemID: "layer-id",
|
||||
},
|
||||
).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
|
||||
),
|
||||
MetadataType: pkg.GolangBinMetadataType,
|
||||
Metadata: pkg.GolangBinMetadata{
|
||||
GoCompiledVersion: goCompiledVersion,
|
||||
Architecture: archDetails,
|
||||
BuildSettings: map[string]string{
|
||||
"GOARCH": archDetails,
|
||||
"GOOS": "darwin",
|
||||
"GOAMD64": "v1",
|
||||
"vcs.revision": "41bc6bb410352845f22766e27dd48ba93aa825a4",
|
||||
"vcs.time": "2022-10-14T19:54:57Z",
|
||||
"-ldflags": `build -ldflags="-w -s -extldflags '-static' -X blah=foobar`,
|
||||
},
|
||||
MainModule: "github.com/anchore/syft",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "parse main mod and replace devel version with one from ldflags",
|
||||
arch: archDetails,
|
||||
mod: &debug.BuildInfo{
|
||||
GoVersion: goCompiledVersion,
|
||||
Main: debug.Module{Path: "github.com/anchore/syft", Version: "(devel)"},
|
||||
Settings: []debug.BuildSetting{
|
||||
{Key: "GOARCH", Value: archDetails},
|
||||
{Key: "GOOS", Value: "darwin"},
|
||||
{Key: "GOAMD64", Value: "v1"},
|
||||
{Key: "vcs.revision", Value: "41bc6bb410352845f22766e27dd48ba93aa825a4"},
|
||||
{Key: "vcs.time", Value: "2022-10-14T19:54:57Z"},
|
||||
{Key: "-ldflags", Value: `build -ldflags="-w -s -extldflags '-static' -X github.com/anchore/syft/internal/version.version=0.79.0`},
|
||||
},
|
||||
},
|
||||
expected: []pkg.Package{
|
||||
{
|
||||
Name: "github.com/anchore/syft",
|
||||
Language: pkg.Go,
|
||||
Type: pkg.GoModulePkg,
|
||||
Version: "v0.79.0",
|
||||
PURL: "pkg:golang/github.com/anchore/syft@v0.79.0",
|
||||
Locations: source.NewLocationSet(
|
||||
source.NewLocationFromCoordinates(
|
||||
source.Coordinates{
|
||||
RealPath: "/a-path",
|
||||
FileSystemID: "layer-id",
|
||||
},
|
||||
).WithAnnotation(pkg.EvidenceAnnotationKey, pkg.PrimaryEvidenceAnnotation),
|
||||
),
|
||||
MetadataType: pkg.GolangBinMetadataType,
|
||||
Metadata: pkg.GolangBinMetadata{
|
||||
GoCompiledVersion: goCompiledVersion,
|
||||
Architecture: archDetails,
|
||||
BuildSettings: map[string]string{
|
||||
"GOARCH": archDetails,
|
||||
"GOOS": "darwin",
|
||||
"GOAMD64": "v1",
|
||||
"vcs.revision": "41bc6bb410352845f22766e27dd48ba93aa825a4",
|
||||
"vcs.time": "2022-10-14T19:54:57Z",
|
||||
"-ldflags": `build -ldflags="-w -s -extldflags '-static' -X github.com/anchore/syft/internal/version.version=0.79.0`,
|
||||
},
|
||||
MainModule: "github.com/anchore/syft",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "parse main mod and replace devel version with a pseudo version",
|
||||
arch: archDetails,
|
||||
mod: &debug.BuildInfo{
|
||||
GoVersion: goCompiledVersion,
|
||||
@@ -512,3 +606,161 @@ func TestBuildGoPkgInfo(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func Test_extractVersionFromLDFlags(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
ldflags string
|
||||
wantMajorVersion string
|
||||
wantFullVersion string
|
||||
}{
|
||||
{
|
||||
name: "empty ldflags",
|
||||
ldflags: "",
|
||||
},
|
||||
{
|
||||
name: "syft ldflags",
|
||||
ldflags: ` build -ldflags="-w -s -extldflags '-static' -X github.com/anchore/syft/internal/version.version=0.79.0 -X github.com/anchore/syft/internal/version.gitCommit=b2b332e8b2b66af0905e98b54ebd713a922be1a8 -X github.com/anchore/syft/internal/version.buildDate=2023-04-21T16:20:25Z -X github.com/anchore/syft/internal/version.gitDescription=v0.79.0 "`,
|
||||
wantMajorVersion: "0",
|
||||
wantFullVersion: "v0.79.0",
|
||||
},
|
||||
{
|
||||
name: "kubectl ldflags",
|
||||
ldflags: ` build -asmflags=all=-trimpath=/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes
|
||||
build -compiler=gc
|
||||
build -gcflags="all=-trimpath=/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes "
|
||||
build -ldflags="all=-X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.buildDate=2023-04-12T12:16:51Z' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.buildDate=2023-04-12T12:16:51Z' -X 'k8s.io/client-go/pkg/version.buildDate=2023-04-12T12:16:51Z' -X 'k8s.io/component-base/version.buildDate=2023-04-12T12:16:51Z' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitCommit=a1a87a0a2bcd605820920c6b0e618a8ab7d117d4' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitCommit=a1a87a0a2bcd605820920c6b0e618a8ab7d117d4' -X 'k8s.io/client-go/pkg/version.gitCommit=a1a87a0a2bcd605820920c6b0e618a8ab7d117d4' -X 'k8s.io/component-base/version.gitCommit=a1a87a0a2bcd605820920c6b0e618a8ab7d117d4' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitTreeState=clean' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitTreeState=clean' -X 'k8s.io/client-go/pkg/version.gitTreeState=clean' -X 'k8s.io/component-base/version.gitTreeState=clean' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitVersion=v1.25.9' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitVersion=v1.25.9' -X 'k8s.io/client-go/pkg/version.gitVersion=v1.25.9' -X 'k8s.io/component-base/version.gitVersion=v1.25.9' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitMajor=1' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitMajor=1' -X 'k8s.io/client-go/pkg/version.gitMajor=1' -X 'k8s.io/component-base/version.gitMajor=1' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitMinor=25' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitMinor=25' -X 'k8s.io/client-go/pkg/version.gitMinor=25' -X 'k8s.io/component-base/version.gitMinor=25' -s -w"`,
|
||||
wantMajorVersion: "1",
|
||||
wantFullVersion: "v1.25.9",
|
||||
},
|
||||
{
|
||||
name: "nerdctl ldflags",
|
||||
ldflags: ` build -ldflags="-s -w -X github.com/containerd/nerdctl/pkg/version.Version=v1.3.1 -X github.com/containerd/nerdctl/pkg/version.Revision=b224b280ff3086516763c7335fc0e0997aca617a"`,
|
||||
wantMajorVersion: "1",
|
||||
wantFullVersion: "v1.3.1",
|
||||
},
|
||||
{
|
||||
name: "limactl ldflags",
|
||||
ldflags: ` build -ldflags="-s -w -X github.com/lima-vm/lima/pkg/version.Version=v0.15.1"`,
|
||||
wantMajorVersion: "0",
|
||||
wantFullVersion: "v0.15.1",
|
||||
},
|
||||
{
|
||||
name: "terraform ldflags",
|
||||
ldflags: ` build -ldflags="-w -s -X 'github.com/hashicorp/terraform/version.Version=1.4.6' -X 'github.com/hashicorp/terraform/version.Prerelease='"`,
|
||||
wantMajorVersion: "1",
|
||||
wantFullVersion: "v1.4.6",
|
||||
},
|
||||
{
|
||||
name: "kube-apiserver ldflags",
|
||||
ldflags: ` build -asmflags=all=-trimpath=/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes
|
||||
build -buildmode=exe
|
||||
build -compiler=gc
|
||||
build -gcflags="all=-trimpath=/workspace/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes "
|
||||
build -ldflags="all=-X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.buildDate=2023-04-14T13:14:42Z' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.buildDate=2023-04-14T13:14:42Z' -X 'k8s.io/client-go/pkg/version.buildDate=2023-04-14T13:14:42Z' -X 'k8s.io/component-base/version.buildDate=2023-04-14T13:14:42Z' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitCommit=4c9411232e10168d7b050c49a1b59f6df9d7ea4b' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitCommit=4c9411232e10168d7b050c49a1b59f6df9d7ea4b' -X 'k8s.io/client-go/pkg/version.gitCommit=4c9411232e10168d7b050c49a1b59f6df9d7ea4b' -X 'k8s.io/component-base/version.gitCommit=4c9411232e10168d7b050c49a1b59f6df9d7ea4b' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitTreeState=clean' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitTreeState=clean' -X 'k8s.io/client-go/pkg/version.gitTreeState=clean' -X 'k8s.io/component-base/version.gitTreeState=clean' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitVersion=v1.27.1' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitVersion=v1.27.1' -X 'k8s.io/client-go/pkg/version.gitVersion=v1.27.1' -X 'k8s.io/component-base/version.gitVersion=v1.27.1' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitMajor=1' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitMajor=1' -X 'k8s.io/client-go/pkg/version.gitMajor=1' -X 'k8s.io/component-base/version.gitMajor=1' -X 'k8s.io/kubernetes/vendor/k8s.io/client-go/pkg/version.gitMinor=27' -X 'k8s.io/kubernetes/vendor/k8s.io/component-base/version.gitMinor=27' -X 'k8s.io/client-go/pkg/version.gitMinor=27' -X 'k8s.io/component-base/version.gitMinor=27' -s -w"`,
|
||||
wantMajorVersion: "1",
|
||||
wantFullVersion: "v1.27.1",
|
||||
},
|
||||
{
|
||||
name: "prometheus ldflags",
|
||||
ldflags: ` build -ldflags="-X github.com/prometheus/common/version.Version=2.44.0 -X github.com/prometheus/common/version.Revision=1ac5131f698ebc60f13fe2727f89b115a41f6558 -X github.com/prometheus/common/version.Branch=HEAD -X github.com/prometheus/common/version.BuildUser=root@739e8181c5db -X github.com/prometheus/common/version.BuildDate=20230514-06:18:11 -extldflags '-static'"
|
||||
build -tags=netgo,builtinassets,stringlabels`,
|
||||
wantMajorVersion: "2",
|
||||
wantFullVersion: "v2.44.0",
|
||||
},
|
||||
{
|
||||
name: "influxdb ldflags",
|
||||
ldflags: ` build -ldflags="-s -w -X main.version=v2.7.1 -X main.commit=407fa622e9 -X main.date=2023-04-28T13:24:27Z -linkmode=external -extld=/musl/x86_64/bin/musl-gcc -extldflags '-fno-PIC -static-pie -Wl,-z,stack-size=8388608'"
|
||||
build -tags=assets,sqlite_foreign_keys,sqlite_json,static_build,noasm`,
|
||||
wantMajorVersion: "2",
|
||||
wantFullVersion: "v2.7.1",
|
||||
},
|
||||
{
|
||||
name: "gitea ldflags",
|
||||
ldflags: ` build -ldflags=" -X \"main.MakeVersion=GNU Make 4.1\" -X \"main.Version=1.19.3\" -X \"main.Tags=bindata sqlite sqlite_unlock_notify\" "`,
|
||||
wantMajorVersion: "1",
|
||||
wantFullVersion: "v1.19.3",
|
||||
},
|
||||
{
|
||||
name: "docker sbom cli ldflags",
|
||||
ldflags: ` build -ldflags="-w -s -extldflags '-static' -X github.com/docker/sbom-cli-plugin/internal/version.version=0.6.1-SNAPSHOT-02cf1c8 -X github.com/docker/sbom-cli-plugin/internal/version.gitCommit=02cf1c888ad6662109ac6e3be618392514a56316 -X github.com/docker/sbom-cli-plugin/internal/version.gitDescription=v0.6.1-dirty "`,
|
||||
wantMajorVersion: "0",
|
||||
wantFullVersion: "v0.6.1-SNAPSHOT-02cf1c8",
|
||||
},
|
||||
{
|
||||
name: "docker scout ldflags",
|
||||
ldflags: ` build -ldflags="-w -s -extldflags '-static' -X github.com/docker/scout-cli-plugin/internal.version=0.10.0 "`,
|
||||
wantMajorVersion: "0",
|
||||
wantFullVersion: "v0.10.0",
|
||||
},
|
||||
{
|
||||
name: "influx telegraf ldflags",
|
||||
ldflags: ` build -ldflags="-w -s -X github.com/influxdata/telegraf/internal.Commit=a3a884a1 -X github.com/influxdata/telegraf/internal.Branch=HEAD -X github.com/influxdata/telegraf/internal.Version=1.26.2"`,
|
||||
wantMajorVersion: "1",
|
||||
wantFullVersion: "v1.26.2",
|
||||
},
|
||||
{
|
||||
name: "argocd ldflags",
|
||||
ldflags: ` build -ldflags="-X github.com/argoproj/argo-cd/v2/common.version=2.7.2 -X github.com/argoproj/argo-cd/v2/common.buildDate=2023-05-12T14:06:49Z -X github.com/argoproj/argo-cd/v2/common.gitCommit=cbee7e6011407ed2d1066c482db74e97e0cc6bdb -X github.com/argoproj/argo-cd/v2/common.gitTreeState=clean -X github.com/argoproj/argo-cd/v2/common.kubectlVersion=v0.24.2 -extldflags=\"-static\""`,
|
||||
wantMajorVersion: "2",
|
||||
wantFullVersion: "v2.7.2",
|
||||
},
|
||||
{
|
||||
name: "kustomize ldflags",
|
||||
ldflags: ` build -ldflags="-s -X sigs.k8s.io/kustomize/api/provenance.version=kustomize/v4.5.7 -X sigs.k8s.io/kustomize/api/provenance.gitCommit=56d82a8378dfc8dc3b3b1085e5a6e67b82966bd7 -X sigs.k8s.io/kustomize/api/provenance.buildDate=2022-08-02T16:35:54Z "`,
|
||||
wantMajorVersion: "4",
|
||||
wantFullVersion: "v4.5.7",
|
||||
},
|
||||
//////////////////////////////////////////////////////////////////
|
||||
// negative cases
|
||||
{
|
||||
name: "hugo ldflags",
|
||||
ldflags: ` build -ldflags="-s -w -X github.com/gohugoio/hugo/common/hugo.vendorInfo=gohugoio"`,
|
||||
},
|
||||
{
|
||||
name: "ghostunnel ldflags",
|
||||
ldflags: ` build -ldflags="-X main.version=77d9aaa"`,
|
||||
},
|
||||
{
|
||||
name: "opa ldflags",
|
||||
ldflags: `build -ldflags=" -X github.com/open-policy-agent/opa/version.Hostname=9549178459bc"`,
|
||||
},
|
||||
///////////////////////////////////////////////////////////////////
|
||||
// trickier cases
|
||||
{
|
||||
name: "macvlan plugin for cri-o ldflags",
|
||||
ldflags: ` build -ldflags="-extldflags -static -X github.com/containernetworking/plugins/pkg/utils/buildversion.BuildVersion=v1.2.0"`,
|
||||
wantMajorVersion: "1",
|
||||
wantFullVersion: "v1.2.0",
|
||||
},
|
||||
{
|
||||
name: "coder ldflags",
|
||||
ldflags: ` build -ldflags="-s -w -X 'github.com/coder/coder/buildinfo.tag=0.23.4'"`,
|
||||
wantMajorVersion: "0",
|
||||
wantFullVersion: "v0.23.4",
|
||||
},
|
||||
///////////////////////////////////////////////////////////////////
|
||||
// don't know how to handle these... yet
|
||||
//{
|
||||
// // package name: pkgName: "github.com/krakendio/krakend-ce/v2",
|
||||
// name: "krakenD ldflags",
|
||||
// ldflags: ` build -ldflags="-X github.com/luraproject/lura/v2/core.KrakendVersion=2.3.2 -X github.com/luraproject/lura/v2/core.GoVersion=1.20.4 -X github.com/luraproject/lura/v2/core.GlibcVersion=GLIBC-2.31_(debian-11) "`,
|
||||
// wantMajorVersion: "2.3.2",
|
||||
// wantFullVersion: "v2.3.2",
|
||||
//},
|
||||
//{
|
||||
// // package name: pkgName: "github.com/krakendio/krakend-ce/v2",
|
||||
// name: "krakenD ldflags -- answer embedded in the middle",
|
||||
// ldflags: ` build -ldflags=" -X github.com/luraproject/lura/v2/core.GoVersion=1.20.4 -X github.com/luraproject/lura/v2/core.KrakendVersion=2.3.2 -X github.com/luraproject/lura/v2/core.GlibcVersion=GLIBC-2.31_(debian-11) "`,
|
||||
// wantMajorVersion: "2.3.2",
|
||||
// wantFullVersion: "v2.3.2",
|
||||
//},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
gotMajorVersion, gotFullVersion := extractVersionFromLDFlags(tt.ldflags)
|
||||
assert.Equal(t, tt.wantMajorVersion, gotMajorVersion, "unexpected major version")
|
||||
assert.Equal(t, tt.wantFullVersion, gotFullVersion, "unexpected full version")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,10 +3,13 @@ package javascript
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"gopkg.in/yaml.v3"
|
||||
|
||||
"github.com/anchore/syft/internal/log"
|
||||
"github.com/anchore/syft/syft/artifact"
|
||||
"github.com/anchore/syft/syft/pkg"
|
||||
"github.com/anchore/syft/syft/pkg/cataloger/generic"
|
||||
@@ -17,8 +20,9 @@ import (
|
||||
var _ generic.Parser = parsePnpmLock
|
||||
|
||||
type pnpmLockYaml struct {
|
||||
Dependencies map[string]string `json:"dependencies"`
|
||||
Packages map[string]interface{} `json:"packages"`
|
||||
Version string `json:"lockfileVersion" yaml:"lockfileVersion"`
|
||||
Dependencies map[string]interface{} `json:"dependencies" yaml:"dependencies"`
|
||||
Packages map[string]interface{} `json:"packages" yaml:"packages"`
|
||||
}
|
||||
|
||||
func parsePnpmLock(resolver source.FileResolver, _ *generic.Environment, reader source.LocationReadCloser) ([]pkg.Package, []artifact.Relationship, error) {
|
||||
@@ -34,19 +38,55 @@ func parsePnpmLock(resolver source.FileResolver, _ *generic.Environment, reader
|
||||
return nil, nil, fmt.Errorf("failed to parse pnpm-lock.yaml file: %w", err)
|
||||
}
|
||||
|
||||
for name, version := range lockFile.Dependencies {
|
||||
lockVersion, _ := strconv.ParseFloat(lockFile.Version, 64)
|
||||
|
||||
for name, info := range lockFile.Dependencies {
|
||||
version := ""
|
||||
|
||||
switch info := info.(type) {
|
||||
case string:
|
||||
version = info
|
||||
case map[string]interface{}:
|
||||
v, ok := info["version"]
|
||||
if !ok {
|
||||
break
|
||||
}
|
||||
ver, ok := v.(string)
|
||||
if ok {
|
||||
version = parseVersion(ver)
|
||||
}
|
||||
default:
|
||||
log.Tracef("unsupported pnpm dependency type: %+v", info)
|
||||
continue
|
||||
}
|
||||
|
||||
if hasPkg(pkgs, name, version) {
|
||||
continue
|
||||
}
|
||||
|
||||
pkgs = append(pkgs, newPnpmPackage(resolver, reader.Location, name, version))
|
||||
}
|
||||
|
||||
packageNameRegex := regexp.MustCompile(`^/?([^(]*)(?:\(.*\))*$`)
|
||||
splitChar := "/"
|
||||
if lockVersion >= 6.0 {
|
||||
splitChar = "@"
|
||||
}
|
||||
|
||||
// parse packages from packages section of pnpm-lock.yaml
|
||||
for nameVersion := range lockFile.Packages {
|
||||
nameVersionSplit := strings.Split(strings.TrimPrefix(nameVersion, "/"), "/")
|
||||
nameVersion = packageNameRegex.ReplaceAllString(nameVersion, "$1")
|
||||
nameVersionSplit := strings.Split(strings.TrimPrefix(nameVersion, "/"), splitChar)
|
||||
|
||||
// last element in split array is version
|
||||
version := nameVersionSplit[len(nameVersionSplit)-1]
|
||||
|
||||
// construct name from all array items other than last item (version)
|
||||
name := strings.Join(nameVersionSplit[:len(nameVersionSplit)-1], "/")
|
||||
name := strings.Join(nameVersionSplit[:len(nameVersionSplit)-1], splitChar)
|
||||
|
||||
if hasPkg(pkgs, name, version) {
|
||||
continue
|
||||
}
|
||||
|
||||
pkgs = append(pkgs, newPnpmPackage(resolver, reader.Location, name, version))
|
||||
}
|
||||
@@ -55,3 +95,16 @@ func parsePnpmLock(resolver source.FileResolver, _ *generic.Environment, reader
|
||||
|
||||
return pkgs, nil, nil
|
||||
}
|
||||
|
||||
func hasPkg(pkgs []pkg.Package, name, version string) bool {
|
||||
for _, p := range pkgs {
|
||||
if p.Name == name && p.Version == version {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func parseVersion(version string) string {
|
||||
return strings.SplitN(version, "(", 2)[0]
|
||||
}
|
||||
|
||||
@@ -52,3 +52,95 @@ func TestParsePnpmLock(t *testing.T) {
|
||||
|
||||
pkgtest.TestFileParser(t, fixture, parsePnpmLock, expectedPkgs, expectedRelationships)
|
||||
}
|
||||
|
||||
func TestParsePnpmV6Lock(t *testing.T) {
|
||||
var expectedRelationships []artifact.Relationship
|
||||
fixture := "test-fixtures/pnpm-v6/pnpm-lock.yaml"
|
||||
|
||||
locationSet := source.NewLocationSet(source.NewLocation(fixture))
|
||||
|
||||
expectedPkgs := []pkg.Package{
|
||||
{
|
||||
Name: "@testing-library/jest-dom",
|
||||
Version: "5.16.5",
|
||||
PURL: "pkg:npm/%40testing-library/jest-dom@5.16.5",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "@testing-library/react",
|
||||
Version: "13.4.0",
|
||||
PURL: "pkg:npm/%40testing-library/react@13.4.0",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "@testing-library/user-event",
|
||||
Version: "13.5.0",
|
||||
PURL: "pkg:npm/%40testing-library/user-event@13.5.0",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "react",
|
||||
Version: "18.2.0",
|
||||
PURL: "pkg:npm/react@18.2.0",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "react-dom",
|
||||
Version: "18.2.0",
|
||||
PURL: "pkg:npm/react-dom@18.2.0",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "web-vitals",
|
||||
Version: "2.1.4",
|
||||
PURL: "pkg:npm/web-vitals@2.1.4",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "@babel/core",
|
||||
Version: "7.21.4",
|
||||
PURL: "pkg:npm/%40babel/core@7.21.4",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "@types/eslint",
|
||||
Version: "8.37.0",
|
||||
PURL: "pkg:npm/%40types/eslint@8.37.0",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "read-cache",
|
||||
Version: "1.0.0",
|
||||
PURL: "pkg:npm/read-cache@1.0.0",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
{
|
||||
Name: "schema-utils",
|
||||
Version: "3.1.2",
|
||||
PURL: "pkg:npm/schema-utils@3.1.2",
|
||||
Locations: locationSet,
|
||||
Language: pkg.JavaScript,
|
||||
Type: pkg.NpmPkg,
|
||||
},
|
||||
}
|
||||
|
||||
pkgtest.TestFileParser(t, fixture, parsePnpmLock, expectedPkgs, expectedRelationships)
|
||||
}
|
||||
|
||||
@@ -0,0 +1,127 @@
|
||||
lockfileVersion: '6.0'
|
||||
|
||||
dependencies:
|
||||
'@testing-library/jest-dom':
|
||||
specifier: ^5.16.5
|
||||
version: 5.16.5
|
||||
'@testing-library/react':
|
||||
specifier: ^13.4.0
|
||||
version: 13.4.0(react-dom@18.2.0)(react@18.2.0)
|
||||
'@testing-library/user-event':
|
||||
specifier: ^13.5.0
|
||||
version: 13.5.0(@testing-library/dom@9.2.0)
|
||||
react:
|
||||
specifier: ^18.2.0
|
||||
version: 18.2.0
|
||||
react-dom:
|
||||
specifier: ^18.2.0
|
||||
version: 18.2.0(react@18.2.0)
|
||||
web-vitals:
|
||||
specifier: ^2.1.4
|
||||
version: 2.1.4
|
||||
|
||||
packages:
|
||||
/@babel/core@7.21.4:
|
||||
resolution: {integrity: sha512-qt/YV149Jman/6AfmlxJ04LMIu8bMoyl3RB91yTFrxQmgbrSvQMy7cI8Q62FHx1t8wJ8B5fu0UDoLwHAhUo1QA==}
|
||||
engines: {node: '>=6.9.0'}
|
||||
dependencies:
|
||||
'@ampproject/remapping': 2.2.1
|
||||
'@babel/code-frame': 7.21.4
|
||||
'@babel/generator': 7.21.4
|
||||
'@babel/helper-compilation-targets': 7.21.4(@babel/core@7.21.4)
|
||||
'@babel/helper-module-transforms': 7.21.2
|
||||
'@babel/helpers': 7.21.0
|
||||
'@babel/parser': 7.21.4
|
||||
'@babel/template': 7.20.7
|
||||
'@babel/traverse': 7.21.4
|
||||
'@babel/types': 7.21.4
|
||||
convert-source-map: 1.9.0
|
||||
debug: 4.3.4
|
||||
gensync: 1.0.0-beta.2
|
||||
json5: 2.2.3
|
||||
semver: 6.3.0
|
||||
transitivePeerDependencies:
|
||||
- supports-color
|
||||
dev: false
|
||||
|
||||
/@testing-library/jest-dom@5.16.5:
|
||||
resolution: {integrity: sha512-N5ixQ2qKpi5OLYfwQmUb/5mSV9LneAcaUfp32pn4yCnpb8r/Yz0pXFPck21dIicKmi+ta5WRAknkZCfA8refMA==}
|
||||
engines: {node: '>=8', npm: '>=6', yarn: '>=1'}
|
||||
dependencies:
|
||||
'@adobe/css-tools': 4.2.0
|
||||
'@babel/runtime': 7.21.0
|
||||
'@types/testing-library__jest-dom': 5.14.5
|
||||
aria-query: 5.1.3
|
||||
chalk: 3.0.0
|
||||
css.escape: 1.5.1
|
||||
dom-accessibility-api: 0.5.16
|
||||
lodash: 4.17.21
|
||||
redent: 3.0.0
|
||||
dev: false
|
||||
|
||||
/@testing-library/react@13.4.0(react-dom@18.2.0)(react@18.2.0):
|
||||
resolution: {integrity: sha512-sXOGON+WNTh3MLE9rve97ftaZukN3oNf2KjDy7YTx6hcTO2uuLHuCGynMDhFwGw/jYf4OJ2Qk0i4i79qMNNkyw==}
|
||||
engines: {node: '>=12'}
|
||||
peerDependencies:
|
||||
react: ^18.0.0
|
||||
react-dom: ^18.0.0
|
||||
dependencies:
|
||||
'@babel/runtime': 7.21.0
|
||||
'@testing-library/dom': 8.20.0
|
||||
'@types/react-dom': 18.2.1
|
||||
react: 18.2.0
|
||||
react-dom: 18.2.0(react@18.2.0)
|
||||
dev: false
|
||||
|
||||
/@testing-library/user-event@13.5.0(@testing-library/dom@9.2.0):
|
||||
resolution: {integrity: sha512-5Kwtbo3Y/NowpkbRuSepbyMFkZmHgD+vPzYB/RJ4oxt5Gj/avFFBYjhw27cqSVPVw/3a67NK1PbiIr9k4Gwmdg==}
|
||||
engines: {node: '>=10', npm: '>=6'}
|
||||
peerDependencies:
|
||||
'@testing-library/dom': '>=7.21.4'
|
||||
dependencies:
|
||||
'@babel/runtime': 7.21.0
|
||||
'@testing-library/dom': 9.2.0
|
||||
dev: false
|
||||
|
||||
/@types/eslint@8.37.0:
|
||||
resolution: {integrity: sha512-Piet7dG2JBuDIfohBngQ3rCt7MgO9xCO4xIMKxBThCq5PNRB91IjlJ10eJVwfoNtvTErmxLzwBZ7rHZtbOMmFQ==}
|
||||
dependencies:
|
||||
'@types/estree': 1.0.1
|
||||
'@types/json-schema': 7.0.11
|
||||
dev: false
|
||||
|
||||
/react-dom@18.2.0(react@18.2.0):
|
||||
resolution: {integrity: sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==}
|
||||
peerDependencies:
|
||||
react: ^18.2.0
|
||||
dependencies:
|
||||
loose-envify: 1.4.0
|
||||
react: 18.2.0
|
||||
scheduler: 0.23.0
|
||||
dev: false
|
||||
|
||||
/react@18.2.0:
|
||||
resolution: {integrity: sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==}
|
||||
engines: {node: '>=0.10.0'}
|
||||
dependencies:
|
||||
loose-envify: 1.4.0
|
||||
dev: false
|
||||
|
||||
/read-cache@1.0.0:
|
||||
resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
|
||||
dependencies:
|
||||
pify: 2.3.0
|
||||
dev: false
|
||||
|
||||
/schema-utils@3.1.2:
|
||||
resolution: {integrity: sha512-pvjEHOgWc9OWA/f/DE3ohBWTD6EleVLf7iFUkoSwAxttdBhB9QUebQgxER2kWueOvRJXPHNnyrvvh9eZINB8Eg==}
|
||||
engines: {node: '>= 10.13.0'}
|
||||
dependencies:
|
||||
'@types/json-schema': 7.0.11
|
||||
ajv: 6.12.6
|
||||
ajv-keywords: 3.5.2(ajv@6.12.6)
|
||||
dev: false
|
||||
|
||||
/web-vitals@2.1.4:
|
||||
resolution: {integrity: sha512-sVWcwhU5mX6crfI5Vd2dC4qchyTqxV8URinzt25XqVh+bHEPGH4C3NPrNionCP7Obx59wrYEbNlw4Z8sjALzZg==}
|
||||
dev: false
|
||||
+1
-1
@@ -62,7 +62,7 @@ func (l Licenses) Swap(i, j int) {
|
||||
func NewLicense(value string) License {
|
||||
spdxExpression, err := license.ParseExpression(value)
|
||||
if err != nil {
|
||||
log.Trace("unable to parse license expression: %w", err)
|
||||
log.Trace("unable to parse license expression for %q: %w", value, err)
|
||||
}
|
||||
|
||||
return License{
|
||||
|
||||
+16
-2
@@ -216,13 +216,27 @@ func getImageWithRetryStrategy(in Input, registryOptions *image.RegistryOptions)
|
||||
// We need to determine the image source again, such that this determination
|
||||
// doesn't take scheme parsing into account.
|
||||
in.ImageSource = image.DetermineDefaultImagePullSource(in.UserInput)
|
||||
img, err = stereoscope.GetImageFromSource(ctx, in.UserInput, in.ImageSource, opts...)
|
||||
img, userInputErr := stereoscope.GetImageFromSource(ctx, in.UserInput, in.ImageSource, opts...)
|
||||
cleanup = func() {
|
||||
if err := img.Cleanup(); err != nil {
|
||||
log.Warnf("unable to cleanup image=%q: %w", in.UserInput, err)
|
||||
}
|
||||
}
|
||||
return img, cleanup, err
|
||||
if userInputErr != nil {
|
||||
// Image retrieval failed on both tries, we will want to return both errors.
|
||||
return nil, nil, fmt.Errorf(
|
||||
"scheme %q specified; "+
|
||||
"image retrieval using scheme parsing (%s) was unsuccessful: %v; "+
|
||||
"image retrieval without scheme parsing (%s) was unsuccessful: %v",
|
||||
scheme,
|
||||
in.Location,
|
||||
err,
|
||||
in.UserInput,
|
||||
userInputErr,
|
||||
)
|
||||
}
|
||||
|
||||
return img, cleanup, nil
|
||||
}
|
||||
|
||||
func generateDirectorySource(fs afero.Fs, in Input) (*Source, func(), error) {
|
||||
|
||||
Reference in New Issue
Block a user