search

anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
5.73k stars 526 forks source link

fix(golang): improve version extraction from ldflags for pingcap TiDB #2962

Closed westonsteimel closed 2 weeks ago

westonsteimel commented 2 weeks ago

TiDB server is showing the incorrect version:

❯ syft pingcap/tidb:v7.5.0 | grep tidb
...
github.com/pingcap/tidb                                     1.4.4                                  go-module  (+1 duplicate)

This is because ld flag parsing is too restrictive and we're falling back to version detection via looking at the binary contents. This is a fairly large binary (~217 MB) so there aren't good odds at finding the correct version generically this way. The change made in this PR is to loosen the LD flag parsing regex to allow for discovering *ReleaseVersion= arguments.