anchore / grype

A vulnerability scanner for container images and filesystems
Apache License 2.0
8.7k stars 569 forks source link

Flaky checks on STDIN for purl provider #2192

Closed sfc-gh-ylefloch closed 1 day ago

sfc-gh-ylefloch commented 2 weeks ago

What happened:

I tried to run Grype for a single package coming from stdin:

> echo "pkg:rpm/some-rpm" | grype purl:/dev/stdin
failed to catalog: purl file is empty: /dev/stdin

This works on OSX, but not in a Linux container.

What you expected to happen:

The scanning happens as normal on all platforms.

How to reproduce it (as minimally and precisely as possible):

Running the example command above on Linux.

Anything else we need to know?:

That is the same problem as there: https://github.com/golang/go/issues/62392#issuecomment-1702010687

Because there is a check in Grype for the size of the input file, which could be stdin. The behaviour of Size() is system-dependent according to the std docs.

I recommend getting rid of fileHasContent() entirely, since it's only used by the purl provider and doesn't have a reliable behaviour.

Environment:

sfc-gh-ylefloch commented 17 hours ago

Thank you @wagoodman 🙏