feat(mariner): Add support for Azure Linux

[tofay]

Description

Add support for Azure Linux.

Raised this to test the changes in aquasecurity/trivy-db#409

Related issues

• Closes Support for Azure Linux 3.0 (AKA Mariner) #6673

Related PRs

• feat(azure): Add Azure Linux support trivy-db#409

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM
@tofay left a couple of comments.

[DmitriyLewen]

We check etc/mariner-release file for mariner images:

trivy/pkg/fanal/analyzer/os/mariner/mariner.go

Lines 29 to 37 in b76a725

	func (a marinerOSAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) {
	foundOS, err := a.parseRelease(input.Content)
	if err != nil {
	return nil, xerrors.Errorf("release parse error: %w", err)
	}
	return &analyzer.AnalysisResult{
	OS: foundOS,
	}, nil
	}

Does azure contain etc/azure-release file?
if yes - i think we can update logic of this file.

[knqyf263]

Some Distroless images (e.g., Alpine) include only /etc/os-release, not /etc/xxx-version or /etc/xxx-release. So, I think it's better to use /etc/os-release now. I mean we can change mariner.

[DmitriyLewen]

hm... i didn't know about this.
then, i think we need to move logic for mariner-release to os-release

[knqyf263]

Sorry I was confused. Distroless didn't even contain/etc/os-release., and then included /etc/os-release and /etc/alpine-release.
#1975

Here is another discussion about /etc/os-release.
#3485

So, it's anyway good to get a version from /etc/os-release.

[tofay]

Both Mariner and Azure Linux include an /etc/os-release file. Mariner has a /etc/mariner-release and Azure has /etc/azurelinux-release file.

I've removed the mariner-release parsing and updated Mariner to use /etc/os-release parsing. This means that the build ID is removed from the distro in package URLs:

before that change > ExternalRef: PACKAGE-MANAGER purl pkg:rpm/cbl-mariner/[email protected]?arch=x86_64&distro=cbl-mariner-2.0.20240123
after that change > ExternalRef: PACKAGE-MANAGER purl pkg:rpm/cbl-mariner/[email protected]?arch=x86_64&distro=cbl-mariner-2.0

The PURL spec doesn't say what the distro qualifier should be for RPMs. It seems unnecessary to include the build ID since the package can be identified via the other fields.

[DmitriyLewen]

We don't need the assembly ID to detect vulnerabilities.
Looks like we don't need it.

@knqyf263 do you have any objections?

@tofay Can you add tests for detection of 1.0, 2.0 and 3.0 in release_test.go?

[knqyf263]

Looks like we don't need it.

+1

[tofay]

@tofay Can you add tests for detection of 1.0, 2.0 and 3.0 in release_test.go?

Done

[knqyf263]

Merged aquasecurity/trivy-db#409

[knqyf263]

@tofay Is there any public image we can access for testing? I tried azurelinuxpreview.azurecr.io/public/azurelinux/distroless/base, but didn't have access.

[tofay]

@tofay Is there any public image we can access for testing? I tried azurelinuxpreview.azurecr.io/public/azurelinux/distroless/base, but didn't have access.

Did you specify the tag 3.0? The following should be publicly available for testing:

• azurelinuxpreview.azurecr.io/public/azurelinux/base/core:3.0
• azurelinuxpreview.azurecr.io/public/azurelinux/distroless/base:3.0

[DmitriyLewen]

I played around with Mariner 1.0, 2.0 and Azure 3.0 images and found no problems.

[knqyf263]

Did you specify the tag 3.0?

Oh, I missed it. I could pull it. Thanks!

[DmitriyLewen]

go mod tidy should remove this

[DmitriyLewen]

@tofay thanks for your work!
LGTM

[knqyf263]

Is this still relevant?
https://www.githubstatus.com/incidents/m70hk23gx3nx

[tofay]

Is this still relevant? https://www.githubstatus.com/incidents/m70hk23gx3nx

Unsure if the jobs are stuck or if that outage is causing large delays.

[knqyf263]

GitHub is back. I triggered tests.