fix(bitnami): use a different comparer for detecting vulnerabilities

[juan131]

Description

As it's explained at #5622, Bitnami doesn't strictly follow semver versioning since a revision is added to versions using what semver spec consider "pre-releases". Sth similar is done by Debian, see:

• https://manpages.debian.org/wheezy/dpkg-dev/deb-version.5.en.html

This PR adds a new comparer on "detector" pkg for Bitnami based on Bitnami's go-version so Bitnami versions including revisions are properly managed.

Note: refer to "Reproduction Steps" in the original discussion for a "before" and "after" example.

Related issues

• Close False positives on Bitnami packages due to versions with revisions #5622

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Oh, I completely forgot about the constraints. Thanks for the heads-up. I think that logic is too much in Trivy, then. Can we create a new repository, like go-bitnami-version? We can build it on top of go-deb-version. For example, go-npm-version uses go-version as it follows semver, and implements the constraints only as it is npm specific. go-deb-version would be the same. It uses go-deb-version for version comparison and implements the constraints.

We can do that in aquasecurity/go-bitnami-version or bitnami/go-bitnami-version (the repository name is up to you). Which do you prefer?

[juan131]

Let me create the bitnami/go-version repo and ping you back when it's ready.

[juan131]

@knqyf263 the repository has been created and the PR has been adapted to use it:

• https://github.com/bitnami/go-version

[juan131]

Friendly reminder @knqyf263

[knqyf263]

I am currently on vacation due to moving to a new country. I hope to find some time to review, but I don't have much time available. I apologize for any inconvenience caused.

@DmitriyLewen Can you please take a look? If it looks good to you, I'll merge the PR.

[DmitriyLewen]

LGTM
Left 1 comment

@juan131 take a look, please

[DmitriyLewen]

LGTM
@knqyf263 I think we can merge this PR.

[knqyf263]

Thanks! I changed it to a bug fix so we can include it in v0.48.1.

[juan131]

Thanks so much!