Add support for reading ELF package notes with section header #2939
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman
force-pushed
the
fedora-elf-packages
branch
from
3c6d74a to
92917e3
Compare
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
spiffcs
approved these changes
Jun 7, 2024
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #2713
Adds the ability to detect ELF .note.package sections that have json encapsulated by an ELF section header. Today binaries with the section header within the notes section are not valid JSON, thus, are dropped entirely -- this PR will address this and allow them to be added to the SBOM . The section header will be dropped and the remaining JSON will be parsed, resulting in additional ELF packages discovered.
Note there is already existing code in place to remove ELF packages that are already covered by another OS package type (e.g. RPM). This PR allows syft to raise up these ELF packages when the RPM DB has been removed even (useful in distroless cases).