Add support for CBL-Mariner distroless images #1045
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tofay
force-pushed
the
mariner-distroless-support
branch
from
c6d8402
to
0f42494
Compare
These don't contain an RPM database, but contain a file containing the output of an `rpm --query --all ...` command. Signed-off-by: Tom Fay <tomfay@microsoft.com>
tofay
force-pushed
the
mariner-distroless-support
branch
from
0f42494
to
be67d83
Compare
wagoodman
reviewed
Jun 15, 2022
wagoodman
reviewed
Jun 15, 2022
wagoodman
approved these changes
Jun 15, 2022
rather than not parse anything Signed-off-by: Tom Fay <tomfay@microsoft.com>
Signed-off-by: Tom Fay <tomfay@microsoft.com>
|
Thanks for the quick review! I've made the suggested change and one more thing I saw in passing (making parsing resilient to fields being added in future). |
spiffcs
approved these changes
Jun 16, 2022
spiffcs
added a commit
to jonasagx/syft
that referenced
this pull request
Jun 27, 2022
* main: (70 commits) fix: add php catalogers to all catalogers (anchore#1065) feat: add use-all-catalogers flag (anchore#1050) Updates parsing of `yarn.lock` to use `resolved` URLs that are pulled from yarn and npm registries (anchore#926) remove OSS Meetup message (anchore#1057) add pom.xml cataloger (anchore#1055) Add support for CBL-Mariner distroless images (anchore#1045) Add catalogers configuration (anchore#1038) add template output (anchore#1051) update stereoscope to latest version (anchore#1052) update zip_read_closer to incorporate zip64 support (anchore#1041) Add pacman (alpm) parser support (anchore#943) Update of README.md (anchore#1027) bump cosign to v1.9.0 to resolve reporting of GHSA-66x3-6cw3-v5gj (anchore#1025) add workflows to test new project automation (anchore#1023) improve LanguageByName and add unit tests (anchore#1034) Read Description from dpkg status files (anchore#996) Add announcement for Anchore OSS Virtual Meetup (anchore#1033) add main module field to go bin metadata (anchore#1026) Add filters to package cataloger (anchore#1021) change draft to false for release process (anchore#1016) ... Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
aiwantaozi
pushed a commit
to aiwantaozi/syft
that referenced
this pull request
Oct 20, 2022
GijsCalis
pushed a commit
to GijsCalis/syft
that referenced
this pull request
Feb 19, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1044
Mariner distroless images don't contain an RPM database, but contain a file containing the
output of an
rpm --query --all ...command: https://github.com/microsoft/CBL-Mariner/blob/main/toolkit/docs/how_it_works/5_misc.md#rpm-manifest-fileThis PR adds support to syft for detecting that file and extracting package information from it. This is not as much information as syft extracts from a normal RPM database (a couple of examples being file information and signing algorithm) but it is enough information for subsequent CVE analysis.