Skip to content

Support for DPKG (Debian) parser#168

Merged
another-rex merged 10 commits into
google:mainfrom
cmaritan:dpkg-status
Feb 20, 2023
Merged

Support for DPKG (Debian) parser#168
another-rex merged 10 commits into
google:mainfrom
cmaritan:dpkg-status

Conversation

@cmaritan

Copy link
Copy Markdown
Contributor

As discussed in #164 here, this PR adds supports for DPKG parsing.
Structure is similar to APK parser.

@another-rex another-rex requested a review from G-Rath January 31, 2023 23:23
@KoenDG

KoenDG commented Feb 2, 2023

Copy link
Copy Markdown

Just want to chime in this would be very useful

@G-Rath G-Rath left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good! just got one comment about a doc comment :)

Comment thread pkg/lockfile/dpkg-status.go
Comment thread pkg/lockfile/parse.go Outdated

@oliverchang oliverchang left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution! Apologies for the delay in reviewing this.

Comment thread pkg/lockfile/parse.go
Comment thread pkg/lockfile/dpkg-status.go Outdated
Comment thread pkg/lockfile/dpkg-status.go Outdated
@cmaritan

cmaritan commented Feb 8, 2023

Copy link
Copy Markdown
Contributor Author

I also realized that my current parser version is "too aggressive" and can lead to potential false positives.
Status: field is ignored but it can also indicate (rarely I think) that a package is not in installed state.
Will skip everything not in installed or "wanted installed" state in PR update.

@cmaritan

cmaritan commented Feb 12, 2023

Copy link
Copy Markdown
Contributor Author

Hello @oliverchang , now my PR:

  1. For package Name use Source field if present otherwise use Package value (e.g. sudo package)
  2. For package Version use Source value between parenthesis if present otherwise uses Version field
  3. Skip any package that is in not-installed or config-files states, so we are sure that package is not active in the system

@another-rex another-rex left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, just some minor nits.

Comment thread pkg/lockfile/dpkg-status.go Outdated
Comment thread pkg/lockfile/dpkg-status.go Outdated
@cmaritan

Copy link
Copy Markdown
Contributor Author

Thank you @another-rex , committed suggested changes.

@another-rex another-rex merged commit fb4d2c4 into google:main Feb 20, 2023
oliverchang pushed a commit that referenced this pull request Feb 20, 2023
Hello,

ported to APK installed parser common optimizations already merged for
DPKG in #168.
Additionally, a couple of staticcheck linter errors have been corrected
(I think!).
I saw the comments here:
https://github.com/google/osv-scanner/blob/fb4d2c4d8e4e59961db70121e31870593e045a4e/pkg/osvscanner/osvscanner.go#L39-L43
but after my change both lints and tests are ok so it's not clear to me
if comments are now out of date or if I'm missing something!

Comments have been introduced in #149.

Thank you,
Regards.
@cmaritan cmaritan deleted the dpkg-status branch February 20, 2023 23:07
hayleycd pushed a commit that referenced this pull request Mar 9, 2023
As discussed in #164
[here](#164 (comment)),
this PR adds supports for DPKG parsing.
Structure is similar to APK parser.

---------

Co-authored-by: Rex P <106129829+another-rex@users.noreply.github.com>
Co-authored-by: Gareth Jones <Jones258@Gmail.com>
hayleycd pushed a commit that referenced this pull request Mar 9, 2023
Hello,

ported to APK installed parser common optimizations already merged for
DPKG in #168.
Additionally, a couple of staticcheck linter errors have been corrected
(I think!).
I saw the comments here:
https://github.com/google/osv-scanner/blob/fb4d2c4d8e4e59961db70121e31870593e045a4e/pkg/osvscanner/osvscanner.go#L39-L43
but after my change both lints and tests are ok so it's not clear to me
if comments are now out of date or if I'm missing something!

Comments have been introduced in #149.

Thank you,
Regards.
julieqiu pushed a commit to julieqiu/osv-scanner that referenced this pull request May 2, 2023
As discussed in google#164
[here](google#164 (comment)),
this PR adds supports for DPKG parsing.
Structure is similar to APK parser.

---------

Co-authored-by: Rex P <106129829+another-rex@users.noreply.github.com>
Co-authored-by: Gareth Jones <Jones258@Gmail.com>
julieqiu pushed a commit to julieqiu/osv-scanner that referenced this pull request May 2, 2023
Hello,

ported to APK installed parser common optimizations already merged for
DPKG in google#168.
Additionally, a couple of staticcheck linter errors have been corrected
(I think!).
I saw the comments here:
https://github.com/google/osv-scanner/blob/fb4d2c4d8e4e59961db70121e31870593e045a4e/pkg/osvscanner/osvscanner.go#L39-L43
but after my change both lints and tests are ok so it's not clear to me
if comments are now out of date or if I'm missing something!

Comments have been introduced in google#149.

Thank you,
Regards.
julieqiu pushed a commit to julieqiu/osv-scanner that referenced this pull request May 2, 2023
As discussed in google#164
[here](google#164 (comment)),
this PR adds supports for DPKG parsing.
Structure is similar to APK parser.

---------

Co-authored-by: Rex P <106129829+another-rex@users.noreply.github.com>
Co-authored-by: Gareth Jones <Jones258@Gmail.com>
julieqiu pushed a commit to julieqiu/osv-scanner that referenced this pull request May 2, 2023
Hello,

ported to APK installed parser common optimizations already merged for
DPKG in google#168.
Additionally, a couple of staticcheck linter errors have been corrected
(I think!).
I saw the comments here:
https://github.com/google/osv-scanner/blob/fb4d2c4d8e4e59961db70121e31870593e045a4e/pkg/osvscanner/osvscanner.go#L39-L43
but after my change both lints and tests are ok so it's not clear to me
if comments are now out of date or if I'm missing something!

Comments have been introduced in google#149.

Thank you,
Regards.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants