Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The --experimental-offline and --experimental-download-offline-databases are broken for Debian packages #1115

Closed
bernard-dataexpert opened this issue Jul 11, 2024 · 1 comment · Fixed by #1116
Assignees
Labels
bug Something isn't working

Comments

@bernard-dataexpert
Copy link

bernard-dataexpert commented Jul 11, 2024

To reproduce run the following:

 docker run --rm -v "$PWD:$PWD" -w "$PWD" debian cat /var/lib/dpkg/status > dpkg.status
 # works
 docker run --rm -v "$PWD:$PWD" -w "$PWD" ghcr.io/google/osv-scanner:v1.8.2 --lockfile 'dpkg-status:dpkg.status'
 # breaks
 docker run --rm -v "$PWD:$PWD" -w "$PWD" ghcr.io/google/osv-scanner:v1.8.2 --lockfile 'dpkg-status:dpkg.status' --experimental-offline --experimental-download-offline-databases

It works in online mode, but in offline mode it generates the following error:

Scanned /home/ben/dpkg.status file as a dpkg-status and found 88 packages
Loaded Debian:12 local db from /root/.cache/osv-scanner/Debian:12/all.zip
panic: unsupported ecosystem Debian:12

goroutine 1 [running]:
github.com/google/osv-scanner/internal/semantic.MustParse(...)
        github.com/google/osv-scanner/internal/semantic/parse.go:16
github.com/google/osv-scanner/internal/utility/vulns.rangeContainsVersion({{0xc002359930, 0x9}, {0xc00236db80, 0x2, 0x2}, {0x0, 0x0}, 0x0}, {{0xc00044e118, 0x3}, ...})
        github.com/google/osv-scanner/internal/utility/vulns/vulnerability.go:44 +0x351
github.com/google/osv-scanner/internal/utility/vulns.rangeAffectsVersion({0xc002379880?, 0x1, 0x20e5400?}, {{0xc00044e118, 0x3}, {0xc00044e159, 0x7}, {0x0, 0x0}, {0xc00044f6d0, ...}, ...})
        github.com/google/osv-scanner/internal/utility/vulns/vulnerability.go:84 +0x14f
github.com/google/osv-scanner/internal/utility/vulns.IsAffected({{0xc0023599a0, 0x5}, {0xc0023598a0, 0xd}, {0x0, 0xede134012, 0x0}, {0x0, 0xec2c58e08, 0x0}, ...}, ...)
        github.com/google/osv-scanner/internal/utility/vulns/vulnerability.go:153 +0x2a5
github.com/google/osv-scanner/internal/local.(*ZipDB).VulnerabilitiesAffectingPackage(0xc000566748?, {{0xc00044e118, 0x3}, {0xc00044e159, 0x7}, {0x0, 0x0}, {0xc00044f6d0, 0x9}, {0xc00044f6d0, ...}, ...})
        github.com/google/osv-scanner/internal/local/zip.go:239 +0x2d8
github.com/google/osv-scanner/internal/local.MakeRequest({0x17ea9e8, 0xc0002e3f00}, {{0xc00058d000?, 0x4?, 0xc00044fdb0?}}, 0x0, {0x0, 0x0})
        github.com/google/osv-scanner/internal/local/check.go:153 +0x658
github.com/google/osv-scanner/pkg/osvscanner.makeRequest({0x17ea9e8, 0xc0002e3f00}, {0xc0003bf000?, 0x58, 0x130d940?}, 0x1, 0x1, {0x0, 0x0})
        github.com/google/osv-scanner/pkg/osvscanner/osvscanner.go:1025 +0x80a
github.com/google/osv-scanner/pkg/osvscanner.DoScan({{0xc0005b2980, 0x1, 0x1}, {0x0, 0x0, 0x0}, {0x20e3980, 0x0, 0x0}, {0x0, ...}, ...}, ...)
        github.com/google/osv-scanner/pkg/osvscanner/osvscanner.go:896 +0x135c
github.com/google/osv-scanner/cmd/osv-scanner/scan.action(0xc0002e3600, {0x17db5c0, 0xc00007e028}, {0x17db5c0, 0xc00007e030})
        github.com/google/osv-scanner/cmd/osv-scanner/scan/main.go:202 +0xc6e
github.com/google/osv-scanner/cmd/osv-scanner/scan.Command.func2(0xc0001ecb00?)
        github.com/google/osv-scanner/cmd/osv-scanner/scan/main.go:139 +0x2c
github.com/urfave/cli/v2.(*Command).Run(0xc0001ecb00, 0xc0002e3600, {0xc00042f1d0, 0x5, 0x5})
        github.com/urfave/cli/v2@v2.27.2/command.go:276 +0x9dd
github.com/urfave/cli/v2.(*Command).Run(0xc0001ed1e0, 0xc0002e34c0, {0xc0004e8780, 0x6, 0x6})
        github.com/urfave/cli/v2@v2.27.2/command.go:269 +0xc2e
github.com/urfave/cli/v2.(*App).RunContext(0xc00040cc00, {0x17e7568?, 0x20e3980}, {0xc0004e8780, 0x6, 0x6})
        github.com/urfave/cli/v2@v2.27.2/app.go:333 +0x5db
github.com/urfave/cli/v2.(*App).Run(...)
        github.com/urfave/cli/v2@v2.27.2/app.go:307
main.run({0xc00003e0a0, 0x5, 0x5}, {0x17db5c0?, 0xc00007e028}, {0x17db5c0?, 0xc00007e030})
        github.com/google/osv-scanner/cmd/osv-scanner/main.go:52 +0x712
main.main()
        github.com/google/osv-scanner/cmd/osv-scanner/main.go:126 +0x45

@cuixq cuixq added the bug Something isn't working label Jul 12, 2024
@cuixq cuixq self-assigned this Jul 12, 2024
@cuixq
Copy link
Contributor

cuixq commented Jul 12, 2024

I think this is because Debian:12 is not recognized as Debian in [sematic.Parse()[(https://github.com/google/osv-scanner/blob/main/internal/semantic/parse.go#L22).

@another-rex @G-Rath is this expected?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants