wrong traefik rc versions at binary detection #3535
Comments
|
Thanks for the report, @witchcraze! It looks like there are a couple things going on here:
For the first point, should we remove the Traefik classifier and just use the go mod? Are there older versions of traefik that do not include go mod information? Should we tune the regex to exclude certain versions that we know will have go module information? We deduplicate binary package findings if there are owned files by other packages: see the exclude_binaries_by_file_ownership_overlap process for the sets of package types that result in deduplicating binary findings. Should we add golang to the list of catalogers for which if we find a package from, we drop binary packages with overlapping files? |
|
Side note about the regex, I think since the prefix is entirely optional it's allowed to match against the go version embedded nearby: maybe we could ensure that there is a non -(?m)(\x00|\x{FFFD})?v?(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha[0-9]|-beta[0-9]|-rc[0-9])?)\x00
+(?m)(\x00|\x{FFFD})v?(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha[0-9]|-beta[0-9]|-rc[0-9])?)\x00 |
|
Thank you for your comments. I checked ...
I think this is a case of #3485 |
|
Theme for discussion: we have a case where the "expert cataloger" (golang specific one) has less information than the binary cataloger -- what options are there here? |
|
Well, it has less useful version and CPE information, but better package name information |
|
Ideally we'd have some way of merging the two I guess? Some sort of post processing that understands a go pseudoversion with v0.0.0 prefix is less useful than a known version from a binary classifier for the same path. And that the binary classifier CPE is likely better since we took it from the NVD data when we created the classifier. it would be nice to preserve all of the data somewhere though so it could be reviewed |
|
We should probably stop searching within binaries with a simple semver-like pattern within binaries from within the golang cataloger -- this is the source of many FPs. In the meantime we could at least partition the set of classifiers (in the binary cataloger) out and put it into the golang cataloger, so that when there are cases where the buildinfo section is lacking we can still support version detection for a select set of projects. |
What happened:
Some traefik rc versions are not shown correctlly at binary
What you expected to happen:
Proper versions are shown
(or only proper go-module versions are shown)
Steps to reproduce the issue:
Anything else we need to know?:
I think go-module detection was improved, and proper versions seem shown.
Maybe, deleteing traefik binary clasiffier is ok.
// Sorry, I do not understand improvement of go-module detection, I can not judge this.
Environment:
syft version:cat /etc/os-releaseor similar):The text was updated successfully, but these errors were encountered: