search

quay / claircore

foundation modules for scanning container packages and reporting vulnerabilities
https://quay.github.io/claircore/
Apache License 2.0
144 stars 84 forks source link

gobin: rework `go:linkname` abuse #1350

Open hdonnay opened 5 months ago

hdonnay commented 5 months ago

See: golang/go#67401

The gobin package currently uses this to distinguish between "error reading go dependency information" and "not a go binary". If there's some other feature of go-produced ELF or PE binaries we could use as a rule to distinguish them, that would let us (and go upstream) remove this.

hdonnay commented 5 months ago

Poked at this a bit, and there's no good way to get this information without effectively duplicating the stdlib debug/buildinfo package. Detecting any Go-specific feature of an executable means that the first 3/4 of buildinfo.Read needs to be duplicated. At that point, the io.ReaderAt can be handed off to buildinfo.Read to have most of the work duplicated, or we can duplicate the section-decoding logic and call runtime/debug.ParseBuildInfo, thus just re-implementing it. Just exporting the error seems like a tiny change that's easily forwards-compatible if documented to be used with errors.Is.

Opened golang/go#67845 to campaign for exporting the value (or sentinel).