-
Notifications
You must be signed in to change notification settings - Fork 599
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add RPM file scanning support (#1188)
- Loading branch information
Showing
37 changed files
with
470 additions
and
108 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -95,6 +95,16 @@ jobs: | |
| path: syft/pkg/cataloger/java/test-fixtures/java-builds/packages | ||
| key: ${{ runner.os }}-unit-java-cache-${{ hashFiles( 'syft/pkg/cataloger/java/test-fixtures/java-builds/packages.fingerprint' ) }} | ||
|
|
||
| - name: Build cache key for rpm test-fixture blobs (for unit tests) | ||
| run: make rpm-binaries-fingerprint | ||
|
|
||
| - name: Restore RPM test-fixture cache | ||
| id: unit-rpm-cache | ||
| uses: actions/[email protected] | ||
| with: | ||
| path: syft/pkg/cataloger/rpm/test-fixtures/rpms | ||
| key: ${{ runner.os }}-unit-rpm-cache-${{ hashFiles( 'syft/pkg/cataloger/rpm/test-fixtures/rpms.fingerprint' ) }} | ||
|
|
||
| - name: Build cache key for go binary test-fixture blobs (for unit tests) | ||
| run: make go-binaries-fingerprint | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -109,8 +109,8 @@ func Test_encodeComponentProperties(t *testing.T) { | |
| Name: "dive", | ||
| Version: "0.9.2-1", | ||
| Type: pkg.RpmPkg, | ||
| MetadataType: pkg.RpmdbMetadataType, | ||
| Metadata: pkg.RpmdbMetadata{ | ||
| MetadataType: pkg.RpmMetadataType, | ||
| Metadata: pkg.RpmMetadata{ | ||
| Name: "dive", | ||
| Epoch: &epoch, | ||
| Arch: "x86_64", | ||
|
|
@@ -124,7 +124,7 @@ func Test_encodeComponentProperties(t *testing.T) { | |
| }, | ||
| }, | ||
| expected: &[]cyclonedx.Property{ | ||
| {Name: "syft:package:metadataType", Value: "RpmdbMetadata"}, | ||
| {Name: "syft:package:metadataType", Value: "RpmMetadata"}, | ||
| {Name: "syft:package:type", Value: "rpm"}, | ||
| {Name: "syft:metadata:epoch", Value: "2"}, | ||
| {Name: "syft:metadata:release", Value: "1"}, | ||
|
|
@@ -193,29 +193,51 @@ func Test_deriveBomRef(t *testing.T) { | |
| } | ||
|
|
||
| func Test_decodeComponent(t *testing.T) { | ||
| javaComponentWithNoSyftProperties := cyclonedx.Component{ | ||
| Name: "ch.qos.logback/logback-classic", | ||
| Version: "1.2.3", | ||
| PackageURL: "pkg:maven/ch.qos.logback/[email protected]", | ||
| Type: "library", | ||
| BOMRef: "pkg:maven/ch.qos.logback/[email protected]", | ||
| } | ||
|
|
||
| tests := []struct { | ||
| name string | ||
| component cyclonedx.Component | ||
| want pkg.Language | ||
| name string | ||
| component cyclonedx.Component | ||
| wantLanguage pkg.Language | ||
| wantMetadataType pkg.MetadataType | ||
| }{ | ||
| { | ||
| name: "derive language from pURL if missing", | ||
| component: javaComponentWithNoSyftProperties, | ||
| want: pkg.Java, | ||
| name: "derive language from pURL if missing", | ||
| component: cyclonedx.Component{ | ||
| Name: "ch.qos.logback/logback-classic", | ||
| Version: "1.2.3", | ||
| PackageURL: "pkg:maven/ch.qos.logback/[email protected]", | ||
| Type: "library", | ||
| BOMRef: "pkg:maven/ch.qos.logback/[email protected]", | ||
| }, | ||
| wantLanguage: pkg.Java, | ||
| }, | ||
| { | ||
| name: "handle existing RpmdbMetadata type", | ||
| component: cyclonedx.Component{ | ||
| Name: "acl", | ||
| Version: "2.2.53-1.el8", | ||
| PackageURL: "pkg:rpm/centos/[email protected]?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8", | ||
| Type: "library", | ||
| BOMRef: "pkg:rpm/centos/[email protected]?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8", | ||
| Properties: &[]cyclonedx.Property{ | ||
| { | ||
| Name: "syft:package:metadataType", | ||
| Value: "RpmdbMetadata", | ||
| }, | ||
| }, | ||
| }, | ||
| wantMetadataType: pkg.RpmMetadataType, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| assert.Equal(t, tt.want, decodeComponent(&tt.component).Language) | ||
| p := decodeComponent(&tt.component) | ||
| if tt.wantLanguage != "" { | ||
| assert.Equal(t, tt.wantLanguage, p.Language) | ||
| } | ||
| if tt.wantMetadataType != "" { | ||
| assert.Equal(t, tt.wantMetadataType, p.MetadataType) | ||
| } | ||
| }) | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -133,6 +133,45 @@ func Test_unpackMetadata(t *testing.T) { | |
| "purl": "pkg:golang/gopkg.in/square/[email protected]" | ||
| }`), | ||
| }, | ||
| { | ||
| name: "can handle RpmdbMetadata", | ||
| metadataType: pkg.RpmMetadataType, | ||
| packageData: []byte(`{ | ||
| "id": "4ac699c3b8fe1835", | ||
| "name": "acl", | ||
| "version": "2.2.53-1.el8", | ||
| "type": "rpm", | ||
| "foundBy": "rpm-db-cataloger", | ||
| "locations": [ | ||
| { | ||
| "path": "/var/lib/rpm/Packages", | ||
| "layerID": "sha256:74ddd0ec08fa43d09f32636ba91a0a3053b02cb4627c35051aff89f853606b59" | ||
| } | ||
| ], | ||
| "licenses": [ | ||
| "GPLv2+" | ||
| ], | ||
| "language": "", | ||
| "cpes": [ | ||
| "cpe:2.3:a:centos:acl:2.2.53-1.el8:*:*:*:*:*:*:*", | ||
| "cpe:2.3:a:acl:acl:2.2.53-1.el8:*:*:*:*:*:*:*" | ||
| ], | ||
| "purl": "pkg:rpm/centos/[email protected]?arch=x86_64&upstream=acl-2.2.53-1.el8.src.rpm&distro=centos-8", | ||
| "metadataType": "RpmdbMetadata", | ||
| "metadata": { | ||
| "name": "acl", | ||
| "version": "2.2.53", | ||
| "epoch": null, | ||
| "architecture": "x86_64", | ||
| "release": "1.el8", | ||
| "sourceRpm": "acl-2.2.53-1.el8.src.rpm", | ||
| "size": 205740, | ||
| "license": "GPLv2+", | ||
| "vendor": "CentOS", | ||
| "modularityLabel": "" | ||
| } | ||
| }`), | ||
| }, | ||
| { | ||
| name: "bad metadata type is an error", | ||
| metadataType: "BOGOSITY", | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.