test: add E2E tests for AlmaLinux ecosystem mapping by herdiyana256 · Pull Request #2870 · google/osv-scanner

herdiyana256 · 2026-06-09T14:15:10Z

Problem

The AlmaLinux ecosystem mapping was recently implemented and merged in the underlying extractor (google/osv-scalibr#2148). During the review of that PR, maintainer @michaelkedar requested that we also add an End-to-End (E2E) test case within the osv-scanner repository to verify that AlmaLinux images are properly scanned and successfully match advisories from OSV.dev (e.g., ALSA-2022:8299).

Solution

This PR introduces the requested E2E testing for the AlmaLinux ecosystem by adding:

A new Dockerfile fixture test-almalinux-9.Dockerfile based on almalinux:9.0 (which contains a curl package vulnerable to ALSA-2022:8299).
New test cases in cmd/osv-scanner/scan/image/command_test.go to scan the generated AlmaLinux tarball.
Updated snapshots and cassettes demonstrating successful identification of vulnerabilities under the AlmaLinux:9 ecosystem.

Important Note on Ecosystem Format: The ecosystem suffix is explicitly validated as AlmaLinux:9 (major version only, trimming minor/patch versions). This is critical because OSV.dev keys ALSA advisories by major version only. An ecosystem of AlmaLinux:9.8 would incorrectly return 0 vulnerabilities, whereas AlmaLinux:9 successfully matches the 500+ tracked ALSA advisories.

Verification

Tested via make test ACC=true SNAPS=true SHORT=false
Verified that TestCommand_OCIImage/Scanning_AlmaLinux_9_image passes successfully and that the JSON output accurately reflects the expected vulnerabilities.

herdiyana256 · 2026-06-10T14:53:27Z

Hi @michaelkedar, conflicts have been resolved and branch is now rebased onto main.Ready for review!

herdiyana256 · 2026-06-17T10:48:45Z

Hi @michaelkedar,
just a gentle ping on this E2E PR as a follow-up to osv-scalibr#2148 which has been merged. Would you be able to approve the workflows so CI can run? Happy to address any feedback. Thanks!

michaelkedar · 2026-06-18T00:23:11Z

Hi, sorry for the delay

A new Dockerfile fixture test-almalinux-9.Dockerfile based on almalinux:9.0 (which contains a curl package vulnerable to ALSA-2022:8299).

I can't see any ALSA vulnerabilities in the test output at all? Are you sure this is the correct version of the base image to use?

@michaelkedar

…ilities Two root causes were found that prevented ALSA advisories from being detected when scanning AlmaLinux container images: 1. RPM extractor was missing from the "artifact" preset (presets.go): The image scan uses the "artifact" extractor preset which included apk (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.) from AlmaLinux images to be completely ignored. 2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only: /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in google/osv-scalibr#2250; this PR includes a go.mod replace directive to pick up that fix while the upstream PR is reviewed. With both fixes applied, scanning almalinux:9.0 now correctly produces: AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories Fixes google#2870 (responds to @michaelkedar review) Depends on google/osv-scalibr#2250 (ecosystem suffix trim)

herdiyana256 · 2026-06-18T13:14:18Z

Hi @michaelkedar, thanks for the careful review! After digging in, I found two root causes both are now fixed.

Root Cause 1: RPM extractor missing from the artifact preset
The image scan relies on the "artifact" extractor preset in internal/scalibrplugin/presets.go. That preset had apk, dpkg, chisel, and homebrew — but not rpm. So any RPM packages from AlmaLinux images (curl-minimal, openssl, bash, you name it) were just silently skipped during image scanning.

Fix: added rpm.New to the "artifact" preset in presets.go.

Root Cause 2: AlmaLinux ecosystem suffix mismatch
/etc/os-release on almalinux:9.0 sets VERSION_ID="9.0" (point release). The upstream osv-scalibr ecosystem.go was passing this through as-is, so the queried ecosystem became "AlmaLinux:9.0" — but OSV.dev keys all ALSA advisories under the major version only ("AlmaLinux:9"), so zero advisories ever matched.

Quick sanity check: querying AlmaLinux:9 returns ALSA-2022:8299, ALSA-2023:0333, and so on. Querying AlmaLinux:9.0 returns nothing.

Fix: submitted google/osv-scalibr#2250 to strip the VERSION_ID down to major version ("9.0" → "9"). Using a go.mod replace directive to pull in that fix while the upstream PR is still under review.

Verified results
With both fixes in, scanning almalinux:9.0 now correctly surfaces:

Container Scanning Result (AlmaLinux 9.0 (Emerald Puma)):
Total 68 packages affected by 282 known vulnerabilities from 2 ecosystems.
AlmaLinux:9
| curl-minimal    | 7.76.1-14.el9_0.5 | Fix Available | 12 vulns |
| libcurl-minimal | 7.76.1-14.el9_0.5 | Fix Available | 12 vulns |

The almalinux:9.0 image was the right choice — it ships the vulnerable curl-minimal@7.76.1-14.el9_0.5. Fix is pushed and snapshots/cassettes have been regenerated.

@michaelkedar

…ilities Two root causes were found that prevented ALSA advisories from being detected when scanning AlmaLinux container images: 1. RPM extractor was missing from the "artifact" preset (presets.go): The image scan uses the "artifact" extractor preset which included apk (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.) from AlmaLinux images to be completely ignored. 2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only: /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in google/osv-scalibr#2250; this PR includes a go.mod replace directive to pick up that fix while the upstream PR is reviewed. With both fixes applied, scanning almalinux:9.0 now correctly produces: AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories Fixes google#2870 (responds to @michaelkedar review) Depends on google/osv-scalibr#2250 (ecosystem suffix trim)

herdiyana256 · 2026-06-26T03:58:46Z

Hi @michaelkekar, both root causes are now fixed (rpm extractor missing from artifact preset + VERSION_ID trimming via osv-scalibr#2250). Could you approve the workflows so CI can run? Happy to address any feedback. Thanks!

@michaelkedar

Add end-to-end test for scanning Mageia 9 container images to verify that the Mageia ecosystem mapping (added in google/osv-scalibr#2199) is correctly exercised by osv-scanner. Changes: - Add test-mageia-9.Dockerfile fixture based on mageia:9 (pinned to sha256:9f7cd063...) which contains bundled Python wheels with known PyPI vulnerabilities - Add TestCommand_OCIImage/Scanning_Mageia_9_image test case in command_test.go to scan the generated Mageia tarball - Add TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image test case for JSON output format validation - Update snapshots and cassettes with successful scan results This follows the same pattern as the AlmaLinux E2E test (google#2870) as requested by @michaelkedar in google/osv-scalibr#2177. Tested via: make test ACC=true SNAPS=true SHORT=false TestCommand_OCIImage/Scanning_Mageia_9_image passes successfully.

… in PR google#2870)

herdiyana256 · 2026-07-07T12:43:54Z

Hi @michaelkedar, google/osv-scalibr#2250 (trim AlmaLinux VERSION_ID to major version) has been merged into osv-scalibr main. I've dropped the go.mod replace directive and upgraded the module to the official upstream version (v0.4.6-0.20260707071659-fc50b0710740) in f48f051.

Could you approve the workflows so CI can run? Happy to address any feedback. Thanks!

@michaelkedar

…ilities Two root causes were found that prevented ALSA advisories from being detected when scanning AlmaLinux container images: 1. RPM extractor was missing from the "artifact" preset (presets.go): The image scan uses the "artifact" extractor preset which included apk (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.) from AlmaLinux images to be completely ignored. 2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only: /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in google/osv-scalibr#2250; this PR includes a go.mod replace directive to pick up that fix while the upstream PR is reviewed. With both fixes applied, scanning almalinux:9.0 now correctly produces: AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories Fixes google#2870 (responds to @michaelkedar review) Depends on google/osv-scalibr#2250 (ecosystem suffix trim)

herdiyana256 · 2026-07-10T16:12:27Z

Hi @michaelkedar, conflicts resolved branch has been rebased onto current main (3e4dfbe). All snapshot/cassette conflicts were from the upstream snapshot refresh (#2920); AlmaLinux test data is intact. Ready for CI approval!

@michaelkedar

Add end-to-end test for scanning Mageia 9 container images to verify that the Mageia ecosystem mapping (added in google/osv-scalibr#2199) is correctly exercised by osv-scanner. Changes: - Add test-mageia-9.Dockerfile fixture based on mageia:9 (pinned to sha256:9f7cd063...) which contains bundled Python wheels with known PyPI vulnerabilities - Add TestCommand_OCIImage/Scanning_Mageia_9_image test case in command_test.go to scan the generated Mageia tarball - Add TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image test case for JSON output format validation - Update snapshots and cassettes with successful scan results This follows the same pattern as the AlmaLinux E2E test (google#2870) as requested by @michaelkedar in google/osv-scalibr#2177. Tested via: make test ACC=true SNAPS=true SHORT=false TestCommand_OCIImage/Scanning_Mageia_9_image passes successfully.

… in PR google#2870)

@michaelkedar

…ilities Two root causes were found that prevented ALSA advisories from being detected when scanning AlmaLinux container images: 1. RPM extractor was missing from the "artifact" preset (presets.go): The image scan uses the "artifact" extractor preset which included apk (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.) from AlmaLinux images to be completely ignored. 2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only: /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in google/osv-scalibr#2250; this PR includes a go.mod replace directive to pick up that fix while the upstream PR is reviewed. With both fixes applied, scanning almalinux:9.0 now correctly produces: AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories Fixes google#2870 (responds to @michaelkedar review) Depends on google/osv-scalibr#2250 (ecosystem suffix trim)

…nux snapshot - Rebase onto upstream/main (includes snapshot refresh google#2920, google#2921) - Drop go.mod replace directive: google/osv-scalibr#2250 (AlmaLinux VERSION_ID trim) is now merged upstream - Bump osv-scalibr to v0.4.6-0.20260713000915-500ad84f4ed1 (official upstream) - Regenerate TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image snapshot and cassette with updated scalibr

herdiyana256 · 2026-07-13T13:00:44Z

Hi @another-rex, thanks for the approval!

I've pushed a fix to address the prepare_test_image_testdata CI failure:

Rebased onto latest upstream/main (includes snapshot refresh chore: Refresh all snapshots and snapshot diffing #2920/test: include acceptance tests in update-snapshots target #2921)
Dropped the go.mod replace directive pointing to my osv-scalibr fork — extractor/os/rpm: trim AlmaLinux ecosystem suffix to major version osv-scalibr#2250 (AlmaLinux VERSION_ID trim) is now merged upstream
Bumped osv-scalibr to the official v0.4.6-0.20260713000915-500ad84f4ed1
Regenerated TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image snapshot and cassette

All AlmaLinux tests pass locally. The fork replace is gone the PR now uses only official upstream dependencies. Could you approve the workflows so CI can run? Thanks!

Add os/rpm (RPM-based distros: AlmaLinux, RHEL, Rocky, CentOS, Fedora) to the artifact extractor preset. Update all affected snapshot files and fix hardcoded want lists in resolve_test.go to include rpm.Name.

herdiyana256 · 2026-07-16T14:05:04Z

Hi @michaelkedar / @another-rex,

I've pushed a fix for the CI failures, added os/rpm to the test assertions in resolve_test.go and regenerated all affected snapshots.

Could you approve the workflows so CI can run? Thanks!

herdiyana256 · 2026-07-20T04:21:51Z

Hi @michaelkedar @another-rex, gentle follow-up approved but blocked on CodeQL still waiting for results and 5 workflows pending maintainer approval. Could someone approve the workflows so CI/CodeQL can run to completion?

Thanks!

herdiyana256 mentioned this pull request Jun 9, 2026

extractor/os/rpm: add AlmaLinux ecosystem mapping google/osv-scalibr#2148

Closed

herdiyana256 force-pushed the feature/os-almalinux-ecosystem-e2e branch from 607787f to 5fe1e3e Compare June 10, 2026 14:51

herdiyana256 mentioned this pull request Jun 10, 2026

test: add E2E test for Mageia ecosystem mapping #2873

Open

herdiyana256 mentioned this pull request Jun 18, 2026

extractor/os/rpm: trim AlmaLinux ecosystem suffix to major version google/osv-scalibr#2250

Merged

herdiyana256 force-pushed the feature/os-almalinux-ecosystem-e2e branch from 94a8faa to c173341 Compare June 18, 2026 14:39

herdiyana256 changed the title ~~cmd/osv-scanner: add E2E test for AlmaLinux ecosystem mapping~~ test: add E2E tests for AlmaLinux ecosystem mapping Jun 26, 2026

herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jun 26, 2026

cmd/osv-scanner: remove accidentally included AlmaLinux test (belongs…

56c587f

… in PR google#2870)

herdiyana256 force-pushed the feature/os-almalinux-ecosystem-e2e branch from f48f051 to 391a7e4 Compare July 10, 2026 16:10

another-rex approved these changes Jul 13, 2026

View reviewed changes

herdiyana256 added a commit to herdiyana256/osv-scanner that referenced this pull request Jul 13, 2026

cmd/osv-scanner: remove accidentally included AlmaLinux test (belongs…

f839381

… in PR google#2870)

herdiyana256 added 3 commits July 13, 2026 19:58

cmd/osv-scanner: add E2E test for AlmaLinux ecosystem mapping

bc21c2e

herdiyana256 force-pushed the feature/os-almalinux-ecosystem-e2e branch from 1d33105 to 29d5b5f Compare July 13, 2026 13:00

herdiyana256 and others added 2 commits July 14, 2026 15:44

Merge branch 'main' into feature/os-almalinux-ecosystem-e2e

9c97ec0

test: update snapshots for os/rpm in artifact preset

bd22c7f

Add os/rpm (RPM-based distros: AlmaLinux, RHEL, Rocky, CentOS, Fedora) to the artifact extractor preset. Update all affected snapshot files and fix hardcoded want lists in resolve_test.go to include rpm.Name.

Merge branch 'main' into feature/os-almalinux-ecosystem-e2e

862d563

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

test: add E2E tests for AlmaLinux ecosystem mapping#2870

test: add E2E tests for AlmaLinux ecosystem mapping#2870
herdiyana256 wants to merge 6 commits into
google:mainfrom
herdiyana256:feature/os-almalinux-ecosystem-e2e

herdiyana256 commented Jun 9, 2026

Uh oh!

herdiyana256 commented Jun 10, 2026

Uh oh!

herdiyana256 commented Jun 17, 2026

Uh oh!

michaelkedar commented Jun 18, 2026

Uh oh!

herdiyana256 commented Jun 18, 2026 •

edited

Loading

Uh oh!

herdiyana256 commented Jun 26, 2026

Uh oh!

herdiyana256 commented Jul 7, 2026

Uh oh!

herdiyana256 commented Jul 10, 2026

Uh oh!

herdiyana256 commented Jul 13, 2026 •

edited

Loading

Uh oh!

herdiyana256 commented Jul 16, 2026

Uh oh!

herdiyana256 commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

herdiyana256 commented Jun 9, 2026

Problem

Solution

Verification

Uh oh!

herdiyana256 commented Jun 10, 2026

Uh oh!

herdiyana256 commented Jun 17, 2026

Uh oh!

michaelkedar commented Jun 18, 2026

Uh oh!

herdiyana256 commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

herdiyana256 commented Jun 26, 2026

Uh oh!

herdiyana256 commented Jul 7, 2026

Uh oh!

herdiyana256 commented Jul 10, 2026

Uh oh!

herdiyana256 commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

herdiyana256 commented Jul 16, 2026

Uh oh!

herdiyana256 commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

herdiyana256 commented Jun 18, 2026 •

edited

Loading

herdiyana256 commented Jul 13, 2026 •

edited

Loading