TimesysGit / vigiles-buildroot

Vulnerability management tool that provides Buildroot SBOM generation and CVE Analysis of target images.
https://www.timesys.com/vigiles/
10 stars 3 forks source link

Python Exception raised while iterating on packages to filter excluded ones #6

Open schiller-jfn opened 1 year ago

schiller-jfn commented 1 year ago

While looping on packages to compare to filter excluded ones, I get an exception raised.

https://github.com/TimesysGit/vigiles-buildroot/blob/3724195a836176169c4d60fffb9fd65463c42fd3/scripts/amendments.py#L114 SCR-20230601-mcnb

Indeed, in vgls_pkgs dictionary I have two of them which do not have their name in

vgls_pkgs['luainterpreter'] = {'provider': 'luajit', 'version': 'd0e88930ddde28ff662503f9f20facf34f7265aa', 'cve_version': 'd0e88930ddde28ff662503f9f20facf34f7265aa', 'license': 'MIT'}
vgls_pkgs['udev'] = {'provider': 'eudev', 'version': '3.2.11', 'cve_version': '3.2.11', 'license': 'GPL-2.0+ (programs), LGPL-2.1+ (libraries)'}

Seems to be quite similar to #5

harish-bansal commented 1 year ago

Thanks for reporting. We'll rerproduce this issue and get back to you with an update.

harish-bansal commented 1 year ago

Our team was able to reproduce this issue.

luainterpreter and udev are virtual packages provided by luajit and eudev.

The next release will have a fix for improving the handling of virtual packages. In the interim, you can use the below patch to suppress this exception.

diff --git a/scripts/amendments.py b/scripts/amendments.py
index e6fb561..8c2ce71 100644
--- a/scripts/amendments.py
+++ b/scripts/amendments.py
@@ -111,7 +111,7 @@ def _filter_excluded_packages(vgls_pkgs, excld_pkgs):
     pkg_matches = list(set([
         k
         for k, v in vgls_pkgs.items()
-        if v['name'] in excld_pkgs
+        if v.get('name', k) in excld_pkgs
     ]))

     info("Vigiles: Excluding Packages: %s" % sorted(pkg_matches))