chainguard-dev / malcontent

#supply #chain #attack #detection
Apache License 2.0
446 stars 31 forks source link

Better handling of diffs between archives #626

Closed egibs closed 3 days ago

egibs commented 4 days ago

This PR makes some improvements around diffing entire archives. Previously, determining the relative path between the original location of the archive and the extracted files in the temporary directory essentially did not work.

I also modified how paths are represented when displaying the diff regardless of the files being diffed. Instead of displaying relative path -> actual path, we just show actual paths for both now which looks cleaner.

That said, this PR doesn't address the findings in #599 since we're still comparing mismatched map keys in cases like ls and ls.x86_64 (or any equivalent filenames with different extensions).

Examples:

$ go run cmd/mal/mal.go diff /tmp/py3.13-debugpy-bin-1.8.6-r1.apk /tmp/py3.13-debugpy-bin-1.8.7-r0.apk
ā”œā”€ šŸ”µ Changed: /private/tmp/py3.13-debugpy-bin-1.8.7-r0.apk āˆ“ /usr/bin/debugpy
ā”‚     ā‰” filesystem [LOW]
ā”‚       šŸ”µ path/usr_bin ā€” path reference within /usr/bin: /usr/bin/python3.13
ā”‚
ā”œā”€ šŸŸ” Moved: /private/tmp/py3.13-debugpy-bin-1.8.6-r1.apk āˆ“ /var/lib/db/sbom/py3.13-debugpy-bin-1.8.6-r1.spdx.json -> /private/tmp/py3.13-debugpy-bin-1.8.7-r0.apk āˆ“ /var/lib/db/sbom/py3.13-debugpy-bin-1.8.7-r0.spdx.json (score: 0.983784)
ā”‚

$ cd /tmp
$ $HOME/go/1.23.2/bin/mal diff py3.13-debugpy-bin-1.8.6-r1.apk py3.13-debugpy-bin-1.8.7-r0.apk
ā”œā”€ šŸ”µ Changed: py3.13-debugpy-bin-1.8.7-r0.apk āˆ“ /usr/bin/debugpy
ā”‚     ā‰” filesystem [LOW]
ā”‚       šŸ”µ path/usr_bin ā€” path reference within /usr/bin: /usr/bin/python3.13
ā”‚
ā”œā”€ šŸŸ” Moved: py3.13-debugpy-bin-1.8.6-r1.apk āˆ“ /var/lib/db/sbom/py3.13-debugpy-bin-1.8.6-r1.spdx.json -> py3.13-debugpy-bin-1.8.7-r0.apk āˆ“ /var/lib/db/sbom/py3.13-debugpy-bin-1.8.7-r0.spdx.json (score: 0.983784)
ā”‚

$ go run cmd/mal/mal.go diff /bin/ls ../malcontent-samples/macOS/clean/ls
ā”œā”€ šŸ”µ Changed: ../malcontent-samples/macOS/clean/ls
ā”‚     ā‰” execution [LOW]
ā”‚       šŸ”µ shell/TERM ā€” Look up or override terminal settings: TERM
ā”‚     ā‰” filesystem [LOW]
ā”‚       šŸ”µ directory/traverse ā€” traverse filesystem hierarchy: _fts_children, _fts_close, _fts_open, _fts_read, _fts_set
ā”‚       šŸ”µ link_read ā€” read value of a symbolic link: readlink
ā”‚