mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 15:06:36 +01:00
Pujitha PaladuguandPujitha Paladugu
12f0e2d837
Motivation: the envoy binary classifier returns no package for envoy 1.37.1, 1.40.0 and 1.40.1 (the official envoyproxy/envoy images), while neighbouring versions such as 1.37.0 and 1.38.0 are detected. Approach: - the main matcher (NUL-delimited version followed by envoy_reloadable_features) only accepted 1.3x; widen it to 1.[34]x, which covers 1.40.0 and 1.40.1. - in the 1.37.1 binary the version string sits between different neighbouring strings, so the existing matchers do not fire. Add a matcher anchored on the preceding "DeltaDiscoveryResponse.removed_resources" string. - add snippets, config.yaml entries and test cases for 1.37.1, 1.40.0, 1.40.1 (linux/amd64 images, pinned by digest). Validation: - cd syft/pkg/cataloger/binary && go test . -run 'Test_Cataloger_PositiveCases/envoy' : the three new fixtures fail without the classifiers.go change and all envoy cases pass with it. - golangci-lint run ./syft/pkg/cataloger/binary/... : 0 issues. - Built syft before/after and scanned the full linux/arm64 envoy binaries from the official images: 1.37.1, 1.40.0 and 1.40.1 were not reported before and are reported with the right version after; 1.37.0 and 1.38.0 are unchanged. - Not run: the rest of the package test suite needs docker, which is not available here (Test_PEPackageCataloger etc.), and snippets for other binaries are not downloaded locally. The contrib-build fallback matchers still only accept 1.3x; they are untouched. Report: https://github.com/anchore/syft/issues/5470 Assisted-by: claude-sonnet-5-5 (via Claude Code) Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>