Syft reports the wrong version of the go package from binary (F/P findings on Grype result) #2980
Comments
Dentrax
changed the title
|
Hi @Dentrax, thanks for the report on the issue. Not sure where it's getting that version from, but we'll take a look. |
|
Today we try a variety of strategies to infer the main modules version (vcs info, ldflags, etc) but ultimately this might not result in any version. As a last ditch effort we attempt to look for semver-like strings within the binary, which can be brittle (as evidence of this issue). We can't wait for golang/go#50603 to land so we can depend on a supported mechanism instead of the existing content search we're doing today. |
wagoodman
changed the title
|
We should probably add a facility for the go binary cataloger to take a set of binary classifiers (reusing the binary catalogers code) in cases when a regex for finding the version within a binary is known. At the same time, any regexes we have in the binary classifier we have already for go applications should be ported to the new go binary cataloger config being dreamed up here. |
|
Dev note: it would probably involve modifying the Additionally, there is a Yaml-based binary cataloger experiment I would mention, it could be useful to implement this or some analogous cataloger to make defining rules easier and potentially able to distribute them separately from the syft binary instead of taking exactly what is in the binary classifier today. |
|
|
I'm wondering if this issue has been largely handled by #3660 (cc: @wagoodman and @westonsteimel), with potentially two cases to note...
{
"cpe": "cpe:2.3:a:wolfi:wolfictl:v0.29.1\\+dirty:*:*:*:*:*:*:*",
"source": "syft-generated"
}
],
"purl": "pkg:golang/github.com/wolfi-dev/[email protected]%2Bdirty",
|
Yeah I think the |
x-ref: anchore/grype#2482 |
What happened:
Where is the
3.45.1value coming from?go version -m all ./mattermost
Are those CVEs false-positives?
What you expected to happen:
Syft should mark that
github.com/mattermost/mattermost/server/v8dependency version as8.xinstead of ``3.45.1`?Trivy doesn't find
github.com/mattermost/mattermost/server/v8CVEs.Steps to reproduce the issue:
See the commands above.
Anything else we need to know?:
Workaround is to set something like
-X "main.Version=9.9.0".Environment:
syft version:1.7.0cat /etc/os-releaseor similar):macOSThe text was updated successfully, but these errors were encountered: