Skip to content

extractor/os/rpm: trim AlmaLinux ecosystem suffix to major version#2250

Merged
copybara-service[bot] merged 1 commit into
google:mainfrom
herdiyana256:fix/almalinux-trim-major-version
Jul 7, 2026
Merged

extractor/os/rpm: trim AlmaLinux ecosystem suffix to major version#2250
copybara-service[bot] merged 1 commit into
google:mainfrom
herdiyana256:fix/almalinux-trim-major-version

Conversation

@herdiyana256

@herdiyana256 herdiyana256 commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

PR #2148 mapped ID=almalinux to EcosystemAlmaLinux using the full os-release VERSION_ID as the suffix. On a real host or container, VERSION_ID is a point release (e.g. "9.0", "9.8"), producing the ecosystem "AlmaLinux:9.0".

OSV.dev keys AlmaLinux (ALSA) advisories by major version only ("AlmaLinux:9"), so the point-release suffix matches zero advisories.

Empirical check

Using almalinux:9.0 docker image (curl-minimal-7.76.1-14.el9_0.5):

Ecosystem queried Packages with vulns Vuln refs
AlmaLinux:9 matches ALSA-2022:8299 curl vulnerable
AlmaLinux:9.0 0 packages 0 vulns

Fix

Trim VERSION_ID to the part before the first "." so:

  • "9.0" → "9"
  • "9.8" → "9"
  • "8.9" → "8"

A bare major such as "9" is returned unchanged by strings.Cut.

Testing

  • Added test cases for point releases (9.0, 9.8, 8.9) in ecosystem_test.go
  • All existing tests continue to pass

Fixes #2091
Related to: google/osv-scanner#2870

herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jun 18, 2026
@herdiyana256
cmd/osv-scanner: fix AlmaLinux image scanning to detect ALSA vulnerab…
94a8faa 
…ilities

Two root causes were found that prevented ALSA advisories from being detected
when scanning AlmaLinux container images:

1. RPM extractor was missing from the "artifact" preset (presets.go):
   The image scan uses the "artifact" extractor preset which included apk
   (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm
   extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.)
   from AlmaLinux images to be completely ignored.

2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only:
   /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem
   "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only
   ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in
   google/osv-scalibr#2250; this PR includes a go.mod replace directive to
   pick up that fix while the upstream PR is reviewed.

With both fixes applied, scanning almalinux:9.0 now correctly produces:
  AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems
  curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories

Fixes google#2870 (responds to @michaelkedar review)
Depends on google/osv-scalibr#2250 (ecosystem suffix trim)
@herdiyana256 herdiyana256 mentioned this pull request Jun 18, 2026
Open
herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jun 18, 2026
@herdiyana256
cmd/osv-scanner: fix AlmaLinux image scanning to detect ALSA vulnerab…
c173341 
…ilities

Two root causes were found that prevented ALSA advisories from being detected
when scanning AlmaLinux container images:

1. RPM extractor was missing from the "artifact" preset (presets.go):
   The image scan uses the "artifact" extractor preset which included apk
   (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm
   extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.)
   from AlmaLinux images to be completely ignored.

2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only:
   /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem
   "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only
   ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in
   google/osv-scalibr#2250; this PR includes a go.mod replace directive to
   pick up that fix while the upstream PR is reviewed.

With both fixes applied, scanning almalinux:9.0 now correctly produces:
  AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems
  curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories

Fixes google#2870 (responds to @michaelkedar review)
Depends on google/osv-scalibr#2250 (ecosystem suffix trim)
@herdiyana256

herdiyana256 commented Jun 18, 2026

Copy link
Copy Markdown
Contributor Author

Hi @michaelkedar, this is a small follow-up to the merged #2148. The original mapping passed VERSION_ID through unmodified, so real images produce AlmaLinux:9.0 (point release), which matches zero ALSA advisories on OSV.dev since the ecosystem is keyed by major version only. This 3-line trim fixes that.

It's also currently blocking the E2E test in osv-scanner#2870 (pulled in via a temporary go.mod replace), so getting this merged lets me drop the replace directive there. Would appreciate a review when you have a moment.

Thanks!

@herdiyana256

herdiyana256 commented Jun 26, 2026

Copy link
Copy Markdown
Contributor Author

Hi @michaelkedar, gentle ping on this follow-up to the merged #2148. This 3-line fix is what enables the E2E test in osv-scanner#2870 to surface actual ALSA vulnerabilities (AlmaLinux:9 vs AlmaLinux:9.0). Would appreciate a review when you have a moment. Thanks!

@herdiyana256

herdiyana256 commented Jul 2, 2026

Copy link
Copy Markdown
Contributor Author

Hi @michaelkedar, rebased against current main. This 3-line fix is a prerequisite for the E2E tests in osv-scanner#2870 without it, AlmaLinux:9.0 matches zero advisories. Would appreciate a review when you get a chance!

Ly-Joey
Ly-Joey approved these changes Jul 7, 2026
View reviewed changes

@Ly-Joey Ly-Joey left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @herdiyana256, apologies for our delayed response. The change looks good to me!

@herdiyana256 @Ly-Joey
extractor/os/rpm: trim AlmaLinux ecosystem suffix to major version
b9fa0d7 
OSV.dev keys ALSA advisories by major version only (e.g. "AlmaLinux:9").
VERSION_ID in /etc/os-release is a full point release (e.g. "9.0" or
"9.8"), so the ecosystem produced was "AlmaLinux:9.0" which matches
zero advisories.

Empirical check on AlmaLinux 9.0 docker image (curl-minimal-7.76.1-14.el9_0.5):
  AlmaLinux:9   -> matches ALSA-2022:8299 (curl vulnerable)
  AlmaLinux:9.0 -> 0 matches

Trim VERSION_ID to the part before the first "." so that:
  "9.0" -> "9"
  "9.8" -> "9"
  "8.9" -> "8"

A bare major version such as "9" is returned unchanged by strings.Cut.

Fixes google#2091
@Ly-Joey
Ly-Joey force-pushed the fix/almalinux-trim-major-version branch from 4aa61fb to b9fa0d7 Compare July 7, 2026 01:01
@copybara-service
copybara-service Bot merged commit 8a4b044 into google:main Jul 7, 2026
18 checks passed
herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jul 7, 2026
@herdiyana256
chore: drop go.mod replace, upgrade osv-scalibr to upstream main
f48f051 
google/osv-scalibr#2250 (trim AlmaLinux VERSION_ID to major version)
has been merged into osv-scalibr main. Remove the temporary replace
directive that pointed to the fork and upgrade the module to the
upstream pseudo-version that includes the fix.
herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jul 10, 2026
@herdiyana256
cmd/osv-scanner: fix AlmaLinux image scanning to detect ALSA vulnerab…
7093a7d 
…ilities

Two root causes were found that prevented ALSA advisories from being detected
when scanning AlmaLinux container images:

1. RPM extractor was missing from the "artifact" preset (presets.go):
   The image scan uses the "artifact" extractor preset which included apk
   (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm
   extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.)
   from AlmaLinux images to be completely ignored.

2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only:
   /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem
   "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only
   ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in
   google/osv-scalibr#2250; this PR includes a go.mod replace directive to
   pick up that fix while the upstream PR is reviewed.

With both fixes applied, scanning almalinux:9.0 now correctly produces:
  AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems
  curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories

Fixes google#2870 (responds to @michaelkedar review)
Depends on google/osv-scalibr#2250 (ecosystem suffix trim)
herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jul 10, 2026
@herdiyana256
chore: drop go.mod replace, upgrade osv-scalibr to upstream main
391a7e4 
google/osv-scalibr#2250 (trim AlmaLinux VERSION_ID to major version)
has been merged into osv-scalibr main. Remove the temporary replace
directive that pointed to the fork and upgrade the module to the
upstream pseudo-version that includes the fix.
herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jul 13, 2026
@herdiyana256
cmd/osv-scanner: fix AlmaLinux image scanning to detect ALSA vulnerab…
f995ea5 
…ilities

Two root causes were found that prevented ALSA advisories from being detected
when scanning AlmaLinux container images:

1. RPM extractor was missing from the "artifact" preset (presets.go):
   The image scan uses the "artifact" extractor preset which included apk
   (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm
   extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.)
   from AlmaLinux images to be completely ignored.

2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only:
   /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem
   "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only
   ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in
   google/osv-scalibr#2250; this PR includes a go.mod replace directive to
   pick up that fix while the upstream PR is reviewed.

With both fixes applied, scanning almalinux:9.0 now correctly produces:
  AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems
  curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories

Fixes google#2870 (responds to @michaelkedar review)
Depends on google/osv-scalibr#2250 (ecosystem suffix trim)
herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jul 13, 2026
@herdiyana256
fix: rebase onto main, drop fork replace, bump scalibr, update AlmaLi…
29d5b5f 
…nux snapshot

- Rebase onto upstream/main (includes snapshot refresh google#2920, google#2921)
- Drop go.mod replace directive: google/osv-scalibr#2250 (AlmaLinux VERSION_ID
  trim) is now merged upstream
- Bump osv-scalibr to v0.4.6-0.20260713000915-500ad84f4ed1 (official upstream)
- Regenerate TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image snapshot
  and cassette with updated scalibr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Ly-Joey Ly-Joey Ly-Joey approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

PRP: Fix os/rpm extractor to support AlmaLinux ecosystem (ID=almalinux not mapped, zero ALSA advisories detected)

2 participants

@herdiyana256 @Ly-Joey