fix: add config option to exclude language packages with file ownership overlap#4905
Open
kimjune01 wants to merge 3 commits into
Open
fix: add config option to exclude language packages with file ownership overlap#4905kimjune01 wants to merge 3 commits into
kimjune01 wants to merge 3 commits into
Conversation
Author
|
Pushed two test-only follow-ups (b4844d0, 64376c2): the original tests built |
…ip overlap Adds a new configuration option `exclude-language-overlap-by-ownership` that allows users to exclude language packages (Python, NPM, Ruby, etc.) from the SBOM when they overlap with OS packages (deb, rpm, apk). This prevents duplicate entries for packages installed via system package managers that are also detected by language-specific catalogers. Example: python3-django deb package vs. django Python package The feature is disabled by default to maintain backward compatibility. Resolves anchore#4760 Signed-off-by: June Kim <kimjune01@gmail.com>
Previously the table-driven test built pkg.Package literals without
calling SetID(), leaving every package ID as the empty string. The
collection generated its own ID on Add() but the original literals
remained empty, so the relationship From/To IDs were all '' and
c.Package('') returned nil. The function exited at the nil check
without ever evaluating identifyOverlappingLanguageRelationship, and
the assertion compared two empty strings — the test passed
unconditionally.
Inject panic('reached') before the return: tests passed (proof of
no-op). After SetID() is called and we drop the dynamic logic-mirror
in the assertion, panic injection now triggers — the function is
actually exercised.
Signed-off-by: June Kim <kimjune01@gmail.com>
Same root cause as the prior commit: pkg.Package literals had no IDs, so child.ID() == "" and the assertion compared empty to empty when the function correctly returned "" for the no-match case AND when it should have returned the child ID — both branches passed trivially. Verified by panic injection: prior to this fix the test passed even when the function panicked at entry. Signed-off-by: June Kim <kimjune01@gmail.com>
kimjune01
force-pushed
the
fix/exclude-language-overlap-4760
branch
from
64376c2 to
a0b55b8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4760.
Cause
When OS packages (deb, apk, rpm) install language packages (Python, Ruby, npm, etc.) via system package managers, syft catalogs both the OS package and the language package. The file ownership overlap relationship exists between them, but there was no mechanism to deduplicate.
The existing
exclude-binary-overlap-by-ownershipoption handles binary packages, but an equivalent for language packages was missing.Fix
Adds
exclude-language-overlap-by-ownershipconfig option that removes language packages when they have a file ownership overlap relationship with an OS package. This mirrors the existing binary exclusion logic. The option defaults tofalseto avoid changing existing behavior.The implementation follows the same pattern as
ExcludeBinaryPackagesByFileOwnershipOverlap: iterate relationships, identify OS-parent/language-child pairs, and delete the child package.Tests
Unit tests cover:
Signed-off-by: June Kim kimjune01@gmail.com