Create consul binary classifier #1738
Conversation
Closes anchore#1590 Signed-off-by: Shane Dell <shanedell100@gmail.com>
|
Thanks for the contribution @shanedell -- could you add a test for this? There are a couple ways to do this: either a small binary in the test-fixtures (e.g. copy something like 200 bytes around the version bytes), or downloading the actual binary from an image like these examples. Tests are all here. |
|
@kzantow Absolutely. I am working on that now, I went the dynamic route. However, I have the test setup the same way the other dynamic binaries were doing it but failing with this error: --- FAIL: Test_Cataloger_DefaultClassifiers_PositiveCases (0.72s)
--- FAIL: Test_Cataloger_DefaultClassifiers_PositiveCases/positive-consul-1.15.2 (0.19s)
cataloger_test.go:744:
Error Trace: /Users/sdell/workspaces/anchore/syft/syft/pkg/cataloger/binary/cataloger_test.go:744
Error: "[]" should have 1 item(s), but has 0
Test: Test_Cataloger_DefaultClassifiers_PositiveCases/positive-consul-1.15.2I am not to sure why because the binary is inside of |
|
it's not immediately clear the exact problem -- can you push the code that's failing and we'd be able to troubleshoot more? |
Signed-off-by: Shane Dell <shanedell100@gmail.com>
|
No problem, pushed it up once I saw the comment |
|
It seems that crafting a robust regex for this binary (including former versions of consul) might be a little difficult. Based off of what I'm seeing in the binary: You could get a matching regex with something like: CONSUL_VERSION: (?P<version>\d+\.\d+\.\d+)But this would be rather brittle, as this is focusing on comments in static assets that are included, which could change rather easily between releases. Also, taking a look at the code to bake in the version:
It's changed a little bit over time... not significantly, but the above regex doesn't work well against even v1.10.12 of consul. Looking at the binary directly it seems that the version is being embedded into a large data section: This is fairly common in golang binaries for static data encoded into the If we were to write a regex against syft it would be a little easier (even multiple regexes!): Why?
Wait, why does the syft binary (and others) have null-terminated strings and consul doesn't? Syft (and others) don't have null-terminated strings but this is an implicit behavior of baking in values via building with values being passed in via ldflags: Note that we see ... but we don't see that when the variables are hard coded: // in syft/internal/version/build.go
var version = "0.77.0"
var gitCommit = "dd30c99bc2439cb91e3d084eb21e1040dd5a54dc"
var gitDescription = valueNotProvided
var buildDate = valueNotProvided
var platform = fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH) |
|
I think the best path forward is to try and write a regex that will be keyed off of the static assets in the binary, even though this would be brittle compared to other methods, but seems to be the best path forward for now. |
|
@wagoodman So you think something like you what you suggested, |
|
I think that's the best way forward for now, yes 👍 just be aware that this is brittle so it won't catch earlier versions of consul and may not find future versions of consul. |
… is brittle Signed-off-by: Shane Dell <shanedell100@gmail.com>
* main: Add sections of interest for Gemfile.lock cataloger (#1749) fix: update cache.fingerprint file to java-builds dir (#1748) Add ALPM Metadata to CYCLONEDX and SPDX output formats (#1747) chore: bump stereoscope to latest version (#1741) chore(deps): update bootstrap tools to latest versions (#1744) chore(deps): bump github.com/docker/docker (#1746) Create consul binary classifier (#1738) chore(deps): update bootstrap tools to latest versions (#1740) Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
* Create consul binary classifier Closes anchore#1590 Signed-off-by: Shane Dell <shanedell100@gmail.com> * Create test for consul binary classifier Signed-off-by: Shane Dell <shanedell100@gmail.com> * Update version for consul. Add note that about consul version matcher is brittle Signed-off-by: Shane Dell <shanedell100@gmail.com> --------- Signed-off-by: Shane Dell <shanedell100@gmail.com>
Create consul binary classifier
Closes #1590