fix: Distinguish openjdk vs jdk when using file source #3895
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk>
f52cc8b to
9d5f104
Compare
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk>
wagoodman
reviewed
May 16, 2025
| @@ -88,7 +88,7 @@ func parseJVMRelease(_ context.Context, resolver file.Resolver, _ *generic.Envir | |||
| installDir := path.Dir(reader.Path()) | |||
| files, hasJdk := findJvmFiles(resolver, installDir) | |||
|
|
|||
| vendor, product := jvmPrimaryVendorProduct(ri.Implementor, reader.Path(), ri.ImageType, hasJdk) | |||
| vendor, product := jvmPrimaryVendorProduct(ri.Implementor, string(reader.Reference().RealPath), ri.ImageType, hasJdk) | |||
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman
approved these changes
May 16, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
If the JVM vendor is not parsed from the release file, Syft currently tries to use the file path to distinguish between different JDK versions.
Example of this working:
However when scanning with file source this is detected as OpenJDK:
Currently the jvm parser uses
reader.Path()to get the path to the release file.This comes from the
Locationstruct which will have this path relative to the scan root, for file source this is just the file itself, so parent directory names are lost.You can actually observe the same behaviour with directory source if you point the directory source too "deep" into the path:
$ syft scan dir:./oracle-jdk-se-8/usr/lib/jvm/jdk-1.8-oracle-x64 ✔ Indexed file system oracle-jdk-se-8/usr/lib/jvm/jdk-1.8-oracle-x64 ✔ Cataloged contents 1f9bc8cbd38e7cc6f830fd9d8c3b8612a6518222fd7e9e46a62c1ad1a7f13e90 ├── ✔ Packages [1 packages] ├── ✔ Executables [0 executables] ├── ✔ File digests [2 files] └── ✔ File metadata [2 locations] [0000] WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) NAME VERSION TYPE openjdk 1.8.0_411-b25 binaryWhere as just going one directory "higher" ensures the correct vendor is detected:
$ syft scan dir:./oracle-jdk-se-8/usr/lib/jvm/ ✔ Indexed file system oracle-jdk-se-8/usr/lib/jvm ✔ Cataloged contents 5e2177784cfcdd23632e571bf6d38fdabd75ab540fab813265bbafdb48a86387 ├── ✔ Packages [1 packages] ├── ✔ Executables [0 executables] ├── ✔ File digests [2 files] └── ✔ File metadata [2 locations] [0000] WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) NAME VERSION TYPE jdk 1.8.0_411-b25 binaryInstead, this change uses
reader.Reference().RealPathso that the entire path to the file is taken into account, so that the vendor can be distinguished correctly.Type of change
Checklist: