anchore / grype

A vulnerability scanner for container images and filesystems
Apache License 2.0
8.15k stars 528 forks source link

fix: use location `RealPath` not `String()` for match sorting #1950

Closed luhring closed 2 weeks ago

luhring commented 2 weeks ago

This is a follow-up to #1944. Using String() works mostly for sorting, but I expected String() to return a simple filepath, and instead it returns a funky string like: Location<id=72 RealPath="usr/lib/go/pkg/tool/linux_amd64/buildid">.

This causes issues because the id=<...> value will be sorted lexically, and more than that, it looks like for most paths in Syft, this id value is controlled by an auto-incrementing global variable, so its value will vary quite widely across different execution contexts.

(I'm not sure if anything is depending on this kind of Location< .... > string value... If not, it could potentially be worth considering changing String() to return the RealPath or AccessPath to be friendlier to library consumers.)

This PR updates the sorting logic to use the RealPath for now, which should be stable. Holler if this assumption is incorrect for any reason!