You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have observed status files in real-world filesystems at paths that vary slightly from the set of globs currently searched for by the Debian DB cataloger. The current set of globs is:
In the wild, I've seen usr/lib/dpkg/status (this is currently handled for opkg, but not dpkg). It seems like this would be as simple as chaning the current glob of **/var/lib/dpkg/status to be **/lib/dpkg/status.
In addition, I've observed filesystems built using the Itsy Package Management System (aka 'ipkg') that appear to have the exact same status file format used by Debian (dpkg) and OpenWRT (opkg). I believe that simply adding a glob of **/lib/ipkg/status would handle these filesystems as well. PURL generation for these might need to be re-evaluated, though, as the deb/debian type and namespace would likely not be correct. As far as I can tell from the current PURL spec there is no current specification for ipkg PURLs. I nominate that PURLs for such packages should be in the form of pkg:ipkg/<name>@<version> until official specifications are created.
Why is this needed:
Certain varieties of Debian, OpenWRT, and Ipkg-based filesystems are not being scanned fully by Syft.
The text was updated successfully, but these errors were encountered:
Hey @njv299, thanks for the report. For the first part, I think changing the glob as you suggest would be fine. Do you want to submit a pull request with the change? Or we can put this in our backlog and we will get to it at some point.
For the second part, we are thinking that we should implement ipkg and opkg as separate catalogers for a number of reasons. We're going to open a separate feature request and link to this issue and we can discuss there.
A quick note about the PURL, it looks like the namespace is what we'd want to set for opkg and ipkg types; since there were a few different requests rolled into the description, this can cover expanding the dpkg globs in use.
I added another issue to track the ipkg support; see:
What would you like to be added:
I have observed
status
files in real-world filesystems at paths that vary slightly from the set of globs currently searched for by the Debian DB cataloger. The current set of globs is:In the wild, I've seen
usr/lib/dpkg/status
(this is currently handled foropkg
, but notdpkg
). It seems like this would be as simple as chaning the current glob of**/var/lib/dpkg/status
to be**/lib/dpkg/status
.In addition, I've observed filesystems built using the Itsy Package Management System (aka 'ipkg') that appear to have the exact same
status
file format used by Debian (dpkg) and OpenWRT (opkg). I believe that simply adding a glob of**/lib/ipkg/status
would handle these filesystems as well. PURL generation for these might need to be re-evaluated, though, as thedeb/debian
type and namespace would likely not be correct. As far as I can tell from the current PURL spec there is no current specification foripkg
PURLs. I nominate that PURLs for such packages should be in the form ofpkg:ipkg/<name>@<version>
until official specifications are created.Why is this needed:
Certain varieties of Debian, OpenWRT, and Ipkg-based filesystems are not being scanned fully by Syft.
The text was updated successfully, but these errors were encountered: