Fix warnings in deb cataloger when parsing opkg packages #1994
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What?
This PR is a follow-up to #1985 which expanded the deb cataloger to also catalog debian-derived packages installed with
opkg
. This PR fixes warnings that are generated when I runsyft
against the private image used at my company.Why?
I failed to run
syft
against the private image used at my company before #1985, so I did not see that there were warnings until after the PR had merged.How?
This PR makes it so the deb cataloger only tries to parse
*.control
files under the**/lib/opkg/info/
directory.The warnings shown in the section below are the result of the deb cataloger trying to parse
*.preinst
,*.postinst
,*.prerm
, and*.postrm
files under the**/lib/opkg/info/
directory. There is no need to parse these files, however, since all the package metadata resides in*.control
files.Testing?
Before this PR:
After this PR:
I only observed these errors with the private image used at my company, not with
openwrt/rootfs
. The changes in this PR have no effect on howsyft
catalogs openwrt/rootfs, which (as of the time of this PR) catalogs 197 packages before and after this PR. This PR also does not affect the number of packages identified bysyft
for the private image used at my company;syft
finds 53 packages before the PR, 53 packages after the PR.