chainguard-dev / melange

build APKs from source code
Apache License 2.0
425 stars 105 forks source link

Melange does not detect libraries in other places than `{/usr,}/lib{64,}` #1563

Open gdonval opened 2 weeks ago

gdonval commented 2 weeks ago

I am working on a hairy package (samba), which provides lots of tools and libraries. Since we want to keep container images as small as possible, those tools and libraries need to be broken into small packages.

Samba makes use of rpaths to make its elf binaries look for libraries in various places under /usr/lib/samba. None of which seems to be captured by the dependency scanner.

E.g. smbclient:

$ patchelf --print-needed smbclient 
libreplace-private-samba.so
libsecrets3-private-samba.so
libcli-smb-common-private-samba.so
libmsrpc3-private-samba.so
libcmdline-private-samba.so
libndr-standard.so.0
libsmbconf.so.0
liblibsmb-private-samba.so
libdcerpc-samba-private-samba.so
libsamba-security-private-samba.so
libsamba-credentials-private-samba.so
libsamba-util.so.0
libsamba-errors.so.1
libsamba-hostconfig-private-samba.so
libsamba-debug-private-samba.so
libsamba3-util-private-samba.so
libgenrand-private-samba.so
libpopt.so.0
libtalloc.so.2
libarchive.so.13
libc.so.6
$ sudo melange build ...
2024/10/14 18:02:39 INFO generating package samba-client-smbclient-4.21.0-r0
2024/10/14 18:02:39 INFO scanning for shared object dependencies...
2024/10/14 18:02:39 INFO interpreter for smbclient => /lib64/ld-linux-x86-64.so.2
2024/10/14 18:02:39 INFO   found lib libndr-standard.so.0 for usr/bin/smbclient
2024/10/14 18:02:39 INFO   found lib libsmbconf.so.0 for usr/bin/smbclient
2024/10/14 18:02:39 INFO   found lib libsamba-util.so.0 for usr/bin/smbclient
2024/10/14 18:02:39 INFO   found lib libsamba-errors.so.1 for usr/bin/smbclient
2024/10/14 18:02:39 INFO   found lib libpopt.so.0 for usr/bin/smbclient
2024/10/14 18:02:39 INFO   found lib libtalloc.so.2 for usr/bin/smbclient
2024/10/14 18:02:39 INFO   found lib libarchive.so.13 for usr/bin/smbclient
2024/10/14 18:02:39 INFO   found lib libc.so.6 for usr/bin/smbclient
2024/10/14 18:02:39 INFO scanning for commands...
2024/10/14 18:02:39 INFO   found command usr/bin/smbclient
2024/10/14 18:02:39 INFO scanning for pkg-config data...
2024/10/14 18:02:39 INFO scanning for python modules...
2024/10/14 18:02:39 INFO scanning for ruby gems...
2024/10/14 18:02:39 INFO scanning for shbang deps...
2024/10/14 18:02:39 INFO   runtime:
2024/10/14 18:02:39 INFO     so:ld-linux-x86-64.so.2
2024/10/14 18:02:39 INFO     so:libarchive.so.13
2024/10/14 18:02:39 INFO     so:libc.so.6
2024/10/14 18:02:39 INFO     so:libndr-standard.so.0
2024/10/14 18:02:39 INFO     so:libpopt.so.0
2024/10/14 18:02:39 INFO     so:libsamba-errors.so.1
2024/10/14 18:02:39 INFO     so:libsamba-util.so.0
2024/10/14 18:02:39 INFO     so:libsmbconf.so.0
2024/10/14 18:02:39 INFO     so:libtalloc.so.2
2024/10/14 18:02:39 INFO   provides:
2024/10/14 18:02:39 INFO     cmd:smbclient=4.21.0-r0
2024/10/14 18:02:39 INFO   installed-size: 211243
2024/10/14 18:02:39 INFO   data.tar.gz digest: 88431299436b9a3a5af23caa068d7e7a36f7f1631a861542c38a2db5183a430c
2024/10/14 18:02:39 INFO wrote packages/x86_64/samba-client-smbclient-4.21.0-r0.apk

All (missed) lib*-private-samba.so files are located in /usr/lib/samba. There should be a way to scan those and somehow provide them as:

scanning for shbang deps...
  runtime:
    so:samba/lib*-private-samba.so.X
gdonval commented 2 weeks ago

https://github.com/chainguard-dev/melange/blob/4ee7f9ca6fa6975025c2a5511cbd0e919c691fd4/pkg/sca/sca.go#L175