Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix warnings in deb cataloger when parsing opkg packages #1994

Merged
merged 1 commit into from
Aug 3, 2023
Merged

Fix warnings in deb cataloger when parsing opkg packages #1994

merged 1 commit into from
Aug 3, 2023

Conversation

johnDeSilencio
Copy link
Contributor

@johnDeSilencio johnDeSilencio commented Aug 3, 2023

What?

This PR is a follow-up to #1985 which expanded the deb cataloger to also catalog debian-derived packages installed with opkg. This PR fixes warnings that are generated when I run syft against the private image used at my company.

Why?

I failed to run syft against the private image used at my company before #1985, so I did not see that there were warnings until after the PR had merged.

How?

This PR makes it so the deb cataloger only tries to parse *.control files under the **/lib/opkg/info/ directory.

The warnings shown in the section below are the result of the deb cataloger trying to parse *.preinst, *.postinst, *.prerm, and *.postrm files under the **/lib/opkg/info/ directory. There is no need to parse these files, however, since all the package metadata resides in *.control files.

Testing?

Before this PR:

docker run -it anchore/syft:latest --verbose docker.mycompany.com/privateimage:latest                                                                 [0000]  INFO syft version: 0.0.0-SNAPSHOT-e55277f2
[0000]  INFO identified distro: BusyBox v1.35.0
[0000]  INFO cataloging an image
[0000]  WARN cataloger failed cataloger=dpkgdb-cataloger error=unable to catalog dpkg DB="/var/lib/opkg/info/base-files.preinst": no match for continuation: line: '    #!/bin/sh -e' location=/var/lib/opkg/info/base-files.preinst
[0000]  WARN cataloger failed cataloger=dpkgdb-cataloger error=unable to catalog dpkg DB="/var/lib/opkg/info/base-passwd.preinst": duplicate key discovered: root location=/var/lib/opkg/info/base-passwd.preinst
[0000]  WARN cataloger failed cataloger=dpkgdb-cataloger error=unable to catalog dpkg DB="/var/lib/opkg/info/busybox.postinst": no match for continuation: line: '    # Remove busybox.nosuid if it's a symlink, because this situation indicates' location=/var/lib/opkg/info/busybox.postinst
[0000]  WARN cataloger failed cataloger=dpkgdb-cataloger error=unable to catalog dpkg DB="/var/lib/opkg/info/busybox.postrm": no match for continuation: line: '        # Add path to remove dir in case we removed our only grep' location=/var/lib/opkg/info/busybox.postrm
[0000]  WARN cataloger failed cataloger=dpkgdb-cataloger error=unable to catalog dpkg DB="/var/lib/opkg/info/busybox.prerm": no match for continuation: line: '        # If busybox is the shell, we need to save it since its the lowest priority shell' location=/var/lib/opkg/info/busybox.prerm
[0000]  WARN cataloger failed cataloger=dpkgdb-cataloger error=unable to catalog dpkg DB="/var/lib/opkg/info/ca-certificates.postinst": no match for continuation: line: '    SYSROOT="$D" $D/usr/sbin/update-ca-certificates' location=/var/lib/opkg/info/ca-certificates.postinst
NAME                      VERSION      TYPE
base-files                 2.9.03-r13   deb
base-passwd                2.1.51-r2    deb
// ...
update-alternatives-opkg  1.8.1-r9     deb
wget                      0.99.9-r4    deb

After this PR:

docker run -it anchore/syft:latest --verbose docker.mycompany.com/privateimage:latest

[0000]  INFO syft version: 0.0.0-SNAPSHOT-44543f72
[0000]  INFO identified distro: BusyBox v1.35.0
[0000]  INFO cataloging an image
NAME                      VERSION      TYPE
base-files                2.9.03-r13   deb
base-passwd               2.1.51-r2    deb
// ...
update-alternatives-opkg  1.8.1-r9     deb
wget                      0.99.9-r4    deb

I only observed these errors with the private image used at my company, not with openwrt/rootfs. The changes in this PR have no effect on how syft catalogs openwrt/rootfs, which (as of the time of this PR) catalogs 197 packages before and after this PR. This PR also does not affect the number of packages identified by syft for the private image used at my company; syft finds 53 packages before the PR, 53 packages after the PR.

@kzantow kzantow enabled auto-merge (squash) August 3, 2023 19:29
@kzantow kzantow merged commit 1d6d5f7 into anchore:main Aug 3, 2023
@johnDeSilencio
Copy link
Contributor Author

@kzantow Thank you! Supporting opkg really helps us out. Thank you again for the hard work you all do ❤️

@kzantow kzantow added the changelog-ignore Don't include this issue in the release changelog label Aug 14, 2023
GijsCalis pushed a commit to GijsCalis/syft that referenced this pull request Feb 19, 2024
Signed-off-by: Nicholas R. Smith <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
changelog-ignore Don't include this issue in the release changelog
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants