mirror of
https://github.com/anchore/syft.git
synced 2026-11-06 17:34:21 +01:00
Pujitha PaladuguandPujitha Paladugu
c581c84ff1
Motivation: when gsha256sum, sha256sum and shasum are all absent but openssl
is available, install.sh fails checksum verification. The fallback ran
`openssl -dst openssl dgst -sha256`, which is an invalid command, and would
also have failed on `cut -d ' ' -f a`, an invalid field argument. The
installer exits 1 and installs nothing; checksum verification is not bypassed.
Approach: call `openssl dgst -sha256 "$TARGET"` and take the digest as the
last space-separated token of its "SHA256(file)= <digest>" output
(also "SHA2-256(...)" on OpenSSL 3.x), using POSIX parameter expansion.
Validation: added test_hash_sha256_openssl in test/install/0_checksums_test.sh,
which overrides is_command so only openssl is found and checks the digest of
the fixture archive (file and stdin). Running `sh 0_checksums_test.sh` in
test/install fails on the test before the change ("Invalid command '-dst'")
and passes after. Run on macOS with the system openssl only; the full
installer run from the issue and the container-based make targets were not run.
Report: https://github.com/anchore/syft/issues/5520
Assisted-by: claude-sonnet-5-5 (via Claude Code)
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
101 lines
3.2 KiB
Bash
Executable File
101 lines
3.2 KiB
Bash
Executable File
. test_harness.sh
|
|
|
|
# search for an asset in a release checksums file
|
|
test_search_for_asset_release() {
|
|
fixture=./testdata/syft_0.36.0_checksums.txt
|
|
|
|
# search_for_asset [checksums-file-path] [name] [os] [arch] [format]
|
|
|
|
# positive case
|
|
actual=$(search_for_asset "${fixture}" "syft" "linux" "amd64" "tar.gz")
|
|
assertEquals "syft_0.36.0_linux_amd64.tar.gz" "${actual}" "unable to find release asset"
|
|
|
|
# negative cases
|
|
actual=$(search_for_asset "${fixture}" "syft" "Linux" "amd64" "tar.gz")
|
|
assertEquals "" "${actual}" "found a release asset but did not expect to (os)"
|
|
|
|
actual=$(search_for_asset "${fixture}" "syft" "darwin" "amd64" "rpm")
|
|
assertEquals "" "${actual}" "found a release asset but did not expect to (format)"
|
|
|
|
}
|
|
|
|
run_test_case test_search_for_asset_release
|
|
|
|
|
|
# search for an asset in a snapshot checksums file
|
|
test_search_for_asset_snapshot() {
|
|
fixture=./testdata/syft_0.35.1-SNAPSHOT-d461f63_checksums.txt
|
|
|
|
# search_for_asset [checksums-file-path] [name] [os] [arch] [format]
|
|
|
|
# positive case
|
|
actual=$(search_for_asset "${fixture}" "syft" "linux" "amd64" "rpm")
|
|
assertEquals "syft_0.35.1-SNAPSHOT-d461f63_linux_amd64.rpm" "${actual}" "unable to find snapshot asset"
|
|
|
|
# negative case
|
|
actual=$(search_for_asset "${fixture}" "syft" "linux" "amd64" "zip")
|
|
assertEquals "" "${actual}" "found a snapshot asset but did not expect to (format)"
|
|
}
|
|
|
|
run_test_case test_search_for_asset_snapshot
|
|
|
|
|
|
# verify 256 digest of a file
|
|
test_hash_sha256() {
|
|
target=./testdata/assets/valid/syft_1.5.0_linux_arm64.tar.gz
|
|
|
|
# hash_sha256 [target]
|
|
|
|
# positive case
|
|
actual=$(hash_sha256 "${target}")
|
|
assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum"
|
|
}
|
|
|
|
run_test_case test_hash_sha256
|
|
|
|
# verify 256 digest of a file when openssl is the only available hash tool
|
|
test_hash_sha256_openssl() {
|
|
target=./testdata/assets/valid/syft_1.5.0_linux_arm64.tar.gz
|
|
|
|
# hide the other hash tools (within subshells) so that hash_sha256 falls back to openssl
|
|
actual=$(is_command() { [ "$1" = "openssl" ]; }; hash_sha256 "${target}")
|
|
assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum"
|
|
|
|
actual=$(is_command() { [ "$1" = "openssl" ]; }; hash_sha256 < "${target}")
|
|
assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum (stdin)"
|
|
}
|
|
|
|
run_test_case test_hash_sha256_openssl
|
|
|
|
# verify 256 digest of a file relative to the checksums file
|
|
test_hash_sha256_verify() {
|
|
|
|
# hash_sha256_verify [target] [checksums]
|
|
|
|
|
|
# positive case
|
|
|
|
checksums=./testdata/assets/valid/checksums.txt
|
|
target=./testdata/assets/valid/syft_1.5.0_linux_arm64.tar.gz
|
|
|
|
hash_sha256_verify "${target}" "${checksums}"
|
|
assertEquals "0" "$?" "mismatched checksum"
|
|
|
|
|
|
# negative case
|
|
|
|
# we are expecting error messages, which is confusing to look at in passing tests... disable logging for now
|
|
log_set_priority -1
|
|
|
|
checksums=./testdata/assets/invalid/checksums.txt
|
|
target=./testdata/assets/invalid/syft_1.5.0_linux_arm64.tar.gz
|
|
|
|
hash_sha256_verify "${target}" "${checksums}"
|
|
assertEquals "1" "$?" "verification did not catch mismatched checksum"
|
|
|
|
# restore logging...
|
|
log_set_priority 0
|
|
}
|
|
|
|
run_test_case test_hash_sha256_verify
|