+
Skip to content

Use data driven approach when detecting Alpine:edge and Debian:sid #2556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 24, 2025

Conversation

wagoodman
Copy link
Contributor

@wagoodman wagoodman commented Mar 21, 2025

This removes client-side logic for identifying edge or unstable distro kinds and instead leverages the existing OS overrides table for this matching.

Before these changes:

$ grype -q alpine:edge
NAME        INSTALLED  FIXED-IN   TYPE  VULNERABILITY   SEVERITY                
libcrypto3  3.3.2-r4   3.3.3-r0   apk   CVE-2024-12797  Medium    (alpine:3.20)  
libcrypto3  3.3.2-r4   3.3.2-r5   apk   CVE-2024-13176  Medium    (alpine:3.21)  
libssl3     3.3.2-r4   3.3.3-r0   apk   CVE-2024-12797  Medium    (alpine:3.20)  
libssl3     3.3.2-r4   3.3.2-r5   apk   CVE-2024-13176  Medium    (alpine:3.21)  
musl        1.2.5-r9   1.2.5-r10  apk   CVE-2025-26519  High      (alpine:edge)  
musl-utils  1.2.5-r9   1.2.5-r10  apk   CVE-2025-26519  High      (alpine:edge)

$ grype -q debian:sid
No vulnerabilities found

After these changes (needs a local DB build):

$ grype -q alpine:edge
NAME        INSTALLED  FIXED-IN   TYPE  VULNERABILITY   SEVERITY 
libcrypto3  3.3.2-r4   3.3.3-r0   apk   CVE-2024-12797  Medium    
libcrypto3  3.3.2-r4   3.3.2-r5   apk   CVE-2024-13176  Medium    
libssl3     3.3.2-r4   3.3.3-r0   apk   CVE-2024-12797  Medium    
libssl3     3.3.2-r4   3.3.2-r5   apk   CVE-2024-13176  Medium    
musl        1.2.5-r9   1.2.5-r10  apk   CVE-2025-26519  High      
musl-utils  1.2.5-r9   1.2.5-r10  apk   CVE-2025-26519  High

$ grype -q debian:sid
NAME                INSTALLED                  FIXED-IN  TYPE  VULNERABILITY     SEVERITY   
apt                 2.9.33                               deb   CVE-2011-3374     Negligible  
bsdutils            1:2.40.4-5                           deb   CVE-2022-0563     Negligible  
coreutils           9.5-1+b1                             deb   CVE-2016-2781     Low         
coreutils           9.5-1+b1                             deb   CVE-2017-18018    Negligible  
libapt-pkg7.0       2.9.33                               deb   CVE-2011-3374     Negligible  
libblkid1           2.40.4-5                             deb   CVE-2022-0563     Negligible  
libc-bin            2.41-6                               deb   CVE-2010-4756     Negligible  
libc-bin            2.41-6                               deb   CVE-2018-20796    Negligible  
libc-bin            2.41-6                               deb   CVE-2019-1010022  Negligible  
libc-bin            2.41-6                               deb   CVE-2019-1010023  Negligible  
libc-bin            2.41-6                               deb   CVE-2019-1010024  Negligible  
libc-bin            2.41-6                               deb   CVE-2019-1010025  Negligible  
libc-bin            2.41-6                               deb   CVE-2019-9192     Negligible  
libc6               2.41-6                               deb   CVE-2010-4756     Negligible  
libc6               2.41-6                               deb   CVE-2018-20796    Negligible  
libc6               2.41-6                               deb   CVE-2019-1010022  Negligible  
libc6               2.41-6                               deb   CVE-2019-1010023  Negligible  
libc6               2.41-6                               deb   CVE-2019-1010024  Negligible  
libc6               2.41-6                               deb   CVE-2019-1010025  Negligible  
libc6               2.41-6                               deb   CVE-2019-9192     Negligible  
libmount1           2.40.4-5                             deb   CVE-2022-0563     Negligible  
libpam-modules      1.7.0-3                              deb   CVE-2024-10963    High        
libpam-modules-bin  1.7.0-3                              deb   CVE-2024-10963    High        
libpam-runtime      1.7.0-3                              deb   CVE-2024-10963    High        
libpam0g            1.7.0-3                              deb   CVE-2024-10963    High        
libsmartcols1       2.40.4-5                             deb   CVE-2022-0563     Negligible  
libsystemd0         257.4-3                              deb   CVE-2013-4392     Negligible  
libsystemd0         257.4-3                              deb   CVE-2023-31437    Negligible  
libsystemd0         257.4-3                              deb   CVE-2023-31438    Negligible  
libsystemd0         257.4-3                              deb   CVE-2023-31439    Negligible  
libudev1            257.4-3                              deb   CVE-2013-4392     Negligible  
libudev1            257.4-3                              deb   CVE-2023-31437    Negligible  
libudev1            257.4-3                              deb   CVE-2023-31438    Negligible  
libudev1            257.4-3                              deb   CVE-2023-31439    Negligible  
libuuid1            2.40.4-5                             deb   CVE-2022-0563     Negligible  
login               1:4.16.0-2+really2.40.4-5            deb   CVE-2022-0563     Negligible  
login.defs          1:4.17.3-2                           deb   CVE-2024-56433    Low         
login.defs          1:4.17.3-2                           deb   CVE-2007-5686     Negligible  
mount               2.40.4-5                             deb   CVE-2022-0563     Negligible  
passwd              1:4.17.3-2                           deb   CVE-2024-56433    Low         
passwd              1:4.17.3-2                           deb   CVE-2007-5686     Negligible  
perl-base           5.40.1-2                             deb   CVE-2011-4116     Negligible  
tar                 1.35+dfsg-3.1                        deb   CVE-2005-2541     Negligible  
util-linux          2.40.4-5                             deb   CVE-2022-0563     Negligible

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
@wagoodman wagoodman changed the title Fix data driven approach to distro aliases for rolling kinds Use data driven approach when detecting Alpine:edge and Debian:sid Mar 24, 2025
@wagoodman wagoodman marked this pull request as ready for review March 24, 2025 15:33
@wagoodman wagoodman enabled auto-merge (squash) March 24, 2025 15:34
@wagoodman wagoodman added the bug Something isn't working label Mar 24, 2025

// fields populated in the constructor

major string
Copy link
Contributor

@kzantow kzantow Mar 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think having these unexported fields on an exported struct with exported fields including Version will lead to confusion about populating them. I think we should just remove these and parse the Version string at times it's requested, unless there's a notable performance issue.


// TODO: this is a temporary workaround... in the long term the mock should more strongly enforce
// data overrides and not require this kind of logic being baked into mocks directly.
func mimicV6DistroTypeOverrides(t distro.Type) distro.Type {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there some tests that rely on this? Longer term, I would prefer if we had a separate step the matchers performed to query the provider for OSes, instead of pushing this logic into the stores where it is opaque. I think that could end up being more clear how the overall matching process works and would potentially avoid having this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Longer term I'd hope to not have matching that is test specific and matching that is for production. This code was added to get the mocks to pass and is not used in production.

@wagoodman wagoodman merged commit 97a8552 into main Mar 24, 2025
12 checks passed
@wagoodman wagoodman deleted the fix-rolling-distro-matching branch March 24, 2025 18:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants
点击 这是indexloc提供的php浏览器服务,不要输入任何密码和下载