mirror of
https://github.com/anchore/syft.git
synced 2026-10-31 22:46:36 +01:00
Tom FayandAlex Goodman
3db3efacdc
* Support RPM distros with newer db formats Recent RPM distros (Fedora 33+, CBL-Mariner 2.0+, amazonlinux 2022+) use an sqlite package database in /var/lib/rpm/rpmdb.sqlite, or "ndb" format (SUSE). Remove anchore's fork in favour of the upstream, https://github.com/knqyf263/go-rpmdb, to gain support for these formats. Signed-off-by: Tom Fay <tomfay@microsoft.com> * add exception for modernc.org repos Signed-off-by: Alex Goodman <alex.goodman@anchore.com> * shorten rpmdb helper function Signed-off-by: Alex Goodman <alex.goodman@anchore.com> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
97 lines
2.8 KiB
Go
97 lines
2.8 KiB
Go
package pkg
|
|
|
|
import (
|
|
"fmt"
|
|
"sort"
|
|
"strconv"
|
|
|
|
"github.com/anchore/packageurl-go"
|
|
"github.com/anchore/syft/syft/file"
|
|
"github.com/anchore/syft/syft/linux"
|
|
"github.com/scylladb/go-set/strset"
|
|
)
|
|
|
|
// Packages is the legacy Berkely db based format
|
|
// Packages.db is the "ndb" format used in SUSE
|
|
// rpmdb.sqlite is the sqlite format used in fedora + derivates
|
|
const RpmDBGlob = "**/var/lib/rpm/{Packages,Packages.db,rpmdb.sqlite}"
|
|
|
|
var (
|
|
_ FileOwner = (*RpmdbMetadata)(nil)
|
|
_ urlIdentifier = (*RpmdbMetadata)(nil)
|
|
)
|
|
|
|
// RpmdbMetadata represents all captured data for a RPM DB package entry.
|
|
type RpmdbMetadata struct {
|
|
Name string `json:"name"`
|
|
Version string `json:"version"`
|
|
Epoch *int `json:"epoch" cyclonedx:"epoch" jsonschema:"nullable"`
|
|
Arch string `json:"architecture"`
|
|
Release string `json:"release" cyclonedx:"release"`
|
|
SourceRpm string `json:"sourceRpm" cyclonedx:"sourceRpm"`
|
|
Size int `json:"size" cyclonedx:"size"`
|
|
License string `json:"license"`
|
|
Vendor string `json:"vendor"`
|
|
Files []RpmdbFileRecord `json:"files"`
|
|
}
|
|
|
|
// RpmdbFileRecord represents the file metadata for a single file attributed to a RPM package.
|
|
type RpmdbFileRecord struct {
|
|
Path string `json:"path"`
|
|
Mode RpmdbFileMode `json:"mode"`
|
|
Size int `json:"size"`
|
|
Digest file.Digest `json:"digest"`
|
|
UserName string `json:"userName"`
|
|
GroupName string `json:"groupName"`
|
|
Flags string `json:"flags"`
|
|
}
|
|
|
|
// RpmdbFileMode is the raw file mode for a single file. This can be interpreted as the linux stat.h mode (see https://pubs.opengroup.org/onlinepubs/007908799/xsh/sysstat.h.html)
|
|
type RpmdbFileMode uint16
|
|
|
|
// PackageURL returns the PURL for the specific RHEL package (see https://github.com/package-url/purl-spec)
|
|
func (m RpmdbMetadata) PackageURL(distro *linux.Release) string {
|
|
var namespace string
|
|
if distro != nil {
|
|
namespace = distro.ID
|
|
}
|
|
|
|
qualifiers := map[string]string{
|
|
PURLQualifierArch: m.Arch,
|
|
}
|
|
|
|
if m.Epoch != nil {
|
|
qualifiers[PURLQualifierEpoch] = strconv.Itoa(*m.Epoch)
|
|
}
|
|
|
|
if m.SourceRpm != "" {
|
|
qualifiers[PURLQualifierUpstream] = m.SourceRpm
|
|
}
|
|
|
|
return packageurl.NewPackageURL(
|
|
packageurl.TypeRPM,
|
|
namespace,
|
|
m.Name,
|
|
// for purl the epoch is a qualifier, not part of the version
|
|
// see https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst under the RPM section
|
|
fmt.Sprintf("%s-%s", m.Version, m.Release),
|
|
purlQualifiers(
|
|
qualifiers,
|
|
distro,
|
|
),
|
|
"",
|
|
).ToString()
|
|
}
|
|
|
|
func (m RpmdbMetadata) OwnedFiles() (result []string) {
|
|
s := strset.New()
|
|
for _, f := range m.Files {
|
|
if f.Path != "" {
|
|
s.Add(f.Path)
|
|
}
|
|
}
|
|
result = s.List()
|
|
sort.Strings(result)
|
|
return result
|
|
}
|