mirror of
https://github.com/anchore/syft.git
synced 2026-11-05 00:46:38 +01:00
Alex Goodman
8d5567c423
* feat: catalog CPAN distributions installed by perl clients
Adds `perl` as a language and `cpan` as a package type, with two catalogers behind them.
- `perl-cpan-installed-cataloger` reads `.meta/*/install.json` (cpanm, cpm, carton) and `auto/**/.packlist` (anything installed through `ExtUtils::MakeMaker` or `Module::Build`, including CPAN.pm). Both globs are unanchored, so a local-lib or carton application tree is found the same as a system install.
- `perl-cpan-meta-cataloger` reads an unpacked release's own `META.json` or `META.yml`, gated on a sibling `MANIFEST` so source checkouts are ignored.
Packages are keyed on the **distribution**, not the module, because that is what CPAN, MetaCPAN and the advisory data all use. `LWP.pm` belongs to `libwww-perl` and reporting it as `LWP` would make every advisory for it unreachable. The distribution name comes from `install.json`'s `dist` field, and from the `auto/` path for packlists.
purls are `pkg:cpan/<distribution>@<version>`, with the PAUSE author added as an `author` qualifier when the evidence carries it. Metadata comes in two types: `cpan-distribution` for installed evidence and `cpan-unpacked-release` for a release sitting on disk. The tiers differ in more than a name, so a consumer should not have to string-match a cataloger name to tell them apart: an unpacked release has no PAUSE path and therefore no author and no file list, and "installed and loadable by the interpreter" is a materially stronger claim than "a source tree exists here".
A packlist's version comes from `perllocal.pod`. EUMM writes it and the packlist from the same variables in the same install target, so the `auto/` path segments and the perllocal `Module` name are the same key, and the recorded `VERSION` is what was evaluated at build time rather than what can be read back statically. Scraping `$VERSION` out of the main `.pm` is the fallback, since `NO_PERLLOCAL` suppresses the file and Module::Build never writes one. Three rules pick the stanza: dashed module name, longest `installed into` libdir that prefixes the packlist path, and last match wins because the file is append-only. Without the libdir rule a second perl on the image silently supplies the version.
Where scraping is the fallback, it reads more than a plain `our $VERSION = '...'`. A version declared in the package statement (`package Foo::Bar v1.0.0;`) counts, which matters because a distribution can declare it that way and carry no `$VERSION` at all: `CPAN::02Packages::Search` is one, and without this it reports no version and matches nothing. Fully qualified `$Foo::Bar::VERSION` counts too, which is what older Dist::Zilla emitted and what real `JSON::PP` 2.27300 still carries. `qv('1.2.3')` is handled. A version computed at runtime is not, and those are reported without one rather than guessed at.
Packlist entries are parsed the way `ExtUtils::Packlist` writes them: a line can carry space-separated metadata after the path (`/path/to/File.pm type=file`), which is what `installperl` produces, so the suffix is stripped rather than the line being cut at its first space.
`META.yml` is read alongside `META.json`, because about 43% of current CPAN releases ship no `META.json` and they skew old, which is where the advisories are. Where both sit in one directory the `META.json` wins. A `META.yml` a strict parser rejects skips that directory rather than failing the scan, which is routine rather than defensive for pre-spec releases.
A packlist is literally a file list, so its paths are surfaced through `pkg.FileOwner`. They are reported as recorded, unfiltered: a path the packlist claims and the filesystem lacks means the file was removed or overwritten out from under the installer, which is worth seeing rather than hiding.
Build leftovers under `~/.cpanm/work` and `~/.cpan/build` are skipped. They genuinely are unpacked release tarballs, `MANIFEST` included, so the `MANIFEST` gate admits them and a path exclusion is the only signal available. Without it every distribution on an image that did not clean up is reported twice. The cost is that a tarball deliberately kept under `~/.cpan/build` stops being reported.
Two behaviors that look wrong but are not:
- a distribution can be reported twice at different versions. `libwww-perl` 5.836 bundles `HTTP-Date`, `HTTP-Message` and `LWP-MediaTypes`, and installing it over the modern standalone releases overwrites their `.pm` files. Both versions are genuinely present, so the merge refuses to pair disagreeing versions rather than hiding one.
- a distribution with no readable version is reported without one rather than dropped, so it stays visible.
The coverage boundary is stated in full in the `package perl` doc comment. In short: modules installed from distro packages are out of scope, since packagers strip CPAN metadata with `NO_PACKLIST` and deb, rpm and apk already report them. Core and dual-life distributions bundled with the interpreter have no coverage, because nothing on disk carries their versions; the interpreter itself is reported separately. Vendored trees, `App::FatPacker` output and PAR archives are invisible, because what they carry is module identity with no offline map to a distribution. A packlist-derived name is the installer's `NAME` and may not be the distribution name, which is left to the vulnerability data to resolve.
One correction worth calling out, since it is easy to arrive at twice: a sibling `MANIFEST` is the only thing separating an unpacked release from a source checkout. An earlier version of the guard also rejected any tree containing a `dist.ini`, on the theory that it marked a Dist::Zilla source tree. dzil ships `dist.ini` *inside* the tarballs it builds and lists it in the generated `MANIFEST`, so that exclusion was silently skipping real releases, `URI` among them.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* test(cli): bump coverage image package count for the new perl fixture
The CPAN fixture added to `image-pkg-coverage` (`URI-5.35`) is shared with the CLI suite through a symlink, so the squashed package count goes from 42 to 43.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
* fix(perl): take CPAN distribution name and version from install.json dist
cpanm writes the main module's `$VERSION` into `version` and the release distvname into `dist`, and the two often disagree (`Carp-Assert-More-2.9.0` records `2.009000`). Trimming `version` off `dist` failed on those, so the whole distvname became the package name, and the module version never paired with the packlist record for the same install, which reported the distribution twice.
- name and version are now split out of `dist` at the last `-` followed by a version, as CPAN::DistnameInfo does
- a `-TRIAL` suffix is dropped, so `Try-Tiny-0.26-TRIAL` reports as `Try-Tiny` `0.26`
- the PAUSE path fallback uses the same split
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
63 lines
3.8 KiB
Go
63 lines
3.8 KiB
Go
// Package perl provides Cataloger implementations relating to CPAN distributions within the Perl
|
|
// language ecosystem.
|
|
//
|
|
// Only distribution-level identity is emitted. Three evidence sources are read: install.json under a
|
|
// .meta directory, .packlist paired with perllocal.pod, and an unpacked release's own META.json or
|
|
// META.yml alongside a MANIFEST.
|
|
//
|
|
// The coverage boundary that follows from that:
|
|
//
|
|
// - CPAN-client installs are cataloged wherever they live, including local-lib trees such as an
|
|
// application's local/lib/perl5. cpanm, cpm, and carton write install.json only when the
|
|
// distribution was resolved from a mirror; a local directory or tarball install (cpanm .,
|
|
// cpanm ./Foo-1.0.tar.gz) writes none, and those fall back to the packlist pass. CPAN.pm never
|
|
// writes install.json at all.
|
|
// - A packlist is written by the ExtUtils::MakeMaker and Module::Build install targets unless
|
|
// suppressed with NO_PACKLIST, which is what distro packagers set.
|
|
// - A packlist-derived name is the installer's NAME, which is usually but not always the
|
|
// distribution name: libwww-perl installs to auto/LWP/.packlist. Resolving those to
|
|
// distributions is left to the vulnerability data, which carries the mapping.
|
|
// - Perl modules installed from distro packages are not cataloged here. They carry no CPAN-native
|
|
// metadata, since packagers suppress it, and they are already reported by the deb, rpm, and apk
|
|
// catalogers.
|
|
// - Core and dual-life distributions bundled with the interpreter are not cataloged. No on-disk
|
|
// artifact carries their versions. The interpreter itself is reported separately.
|
|
// - Build leftovers under ~/.cpanm/work and ~/.cpan/build are skipped. They are unpacked release
|
|
// tarballs, MANIFEST included, but they describe a copy that is already installed elsewhere in
|
|
// the same tree.
|
|
// - Vendored .pm trees, App::FatPacker output, and PAR archives are invisible. What they carry is
|
|
// module identity, and there is no offline map from a module to the distribution that shipped
|
|
// it. Fatpacked output does embed the .pm sources verbatim, $VERSION lines included, so the
|
|
// missing fact is the distribution rather than the version.
|
|
// - A cpanfile or cpanfile.snapshot is not parsed yet. The snapshot is a resolved lockfile and
|
|
// the only evidence in a source checkout or CI workspace, where local/ does not exist, so it
|
|
// is deferred rather than out of scope.
|
|
package perl
|
|
|
|
import (
|
|
"github.com/anchore/syft/syft/pkg"
|
|
"github.com/anchore/syft/syft/pkg/cataloger/generic"
|
|
)
|
|
|
|
// NewCpanInstalledCataloger returns a cataloger for CPAN distributions installed on disk.
|
|
// Globs are deliberately unanchored so local-lib trees (carton, cpanm -L) are found wherever they live.
|
|
func NewCpanInstalledCataloger() pkg.Cataloger {
|
|
return generic.NewCataloger("perl-cpan-installed-cataloger").
|
|
WithParserByGlobs(parseInstallJSON, "**/.meta/*/install.json").
|
|
WithParserByGlobs(parsePacklist, "**/auto/**/.packlist").
|
|
// registration order is execution order, and resolvePacklistVersions has to precede
|
|
// mergeDistributions: merging pairs a packlist package to its install.json package only when the
|
|
// versions agree or the packlist version is absent, so filling versions in afterwards splits every
|
|
// distribution whose two evidence kinds disagree into two packages
|
|
WithResolvingProcessors(resolvePacklistVersions).
|
|
WithProcessors(mergeDistributions).
|
|
WithResolvingProcessors(resolveDependencies)
|
|
}
|
|
|
|
// NewCpanMetaCataloger returns a cataloger for unpacked CPAN releases: release tarballs and vendored
|
|
// distribution trees. CPAN client build leftovers are excluded, see isBuildLeftover.
|
|
func NewCpanMetaCataloger() pkg.Cataloger {
|
|
return generic.NewCataloger("perl-cpan-meta-cataloger").
|
|
WithParserByGlobs(parseReleaseMeta, "**/META.json", "**/META.yml")
|
|
}
|