Skip to content

test: add E2E test for Mageia ecosystem mapping #2873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
herdiyana256 wants to merge 8 commits into
base: main
Choose a base branch
from
Open

test: add E2E test for Mageia ecosystem mapping #2873

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
44ddaee
cmd/osv-scanner: add E2E test for Mageia ecosystem mapping
herdiyana256 Jun 10, 2026
47ad52a
cmd/osv-scanner: update cassettes to remove stale entries after rebase
herdiyana256 Jun 26, 2026
f839381
cmd/osv-scanner: remove accidentally included AlmaLinux test (belongs…
herdiyana256 Jun 26, 2026
fb43100
cmd/osv-scanner: add Mageia cassette entries for JSONFormat test
herdiyana256 Jun 26, 2026
7ab2a47
cmd/osv-scanner: fix Mageia cassette - add missing PyPI query interac…
herdiyana256 Jul 2, 2026
af567eb
fix: update Mageia snapshot and bump osv-scalibr to detect Mageia bas…
herdiyana256 Jul 13, 2026
4a72761
Merge branch 'main' into feature/os-mageia-ecosystem-e2e-v2
herdiyana256 Jul 14, 2026
ec033d0
Merge branch 'main' into feature/os-mageia-ecosystem-e2e-v2
herdiyana256 Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
126 changes: 126 additions & 0 deletions cmd/osv-scanner/scan/image/__snapshots__/command_test.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -583,6 +583,35 @@ failed to load image from tarball with path "../../testdata/locks-manyoci-image/

---

[TestCommand_OCIImage/Scanning_Mageia_9_image - 1]
Scanning local image tarball "./testdata/test-mageia-9.tar"

Total 2 packages affected by 9 known vulnerabilities (0 Critical, 3 High, 5 Medium, 1 Low, 0 Unknown) from 1 ecosystem.
9 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+------------+---------+---------------+------------------------------------------------------------+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
+-------------------------------------+------+-----------+------------+---------+---------------+------------------------------------------------------------+
| https://osv.dev/PYSEC-2023-228 | 6.8 | PyPI | pip | 23.0.1 | 23.3 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl |
| https://osv.dev/GHSA-mq26-g339-26xf | | | | | | |
| https://osv.dev/PYSEC-2026-196 | 5.5 | PyPI | pip | 23.0.1 | 26.1.2 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl |
| https://osv.dev/GHSA-4xh5-x5gv-qwph | 5.9 | PyPI | pip | 23.0.1 | 25.3 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl |
| https://osv.dev/GHSA-58qw-9mgm-455v | 4.6 | PyPI | pip | 23.0.1 | 26.1 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl |
| https://osv.dev/GHSA-6vgw-5pg2-w6jp | 2.0 | PyPI | pip | 23.0.1 | 26.0 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl |
| https://osv.dev/GHSA-jp4c-xjxw-mgf9 | 5.3 | PyPI | pip | 23.0.1 | 26.1 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl |
| https://osv.dev/PYSEC-2022-43012 | 8.7 | PyPI | setuptools | 65.5.0 | 65.5.1 | usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl |
| https://osv.dev/GHSA-r9hx-vwmv-q579 | | | | | | |
| https://osv.dev/PYSEC-2025-49 | 8.8 | PyPI | setuptools | 65.5.0 | 78.1.1 | usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl |
| https://osv.dev/GHSA-5rjg-fvgr-3xxf | | | | | | |
| https://osv.dev/GHSA-cx63-2mw6-8hw5 | 8.8 | PyPI | setuptools | 65.5.0 | 70.0.0 | usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl |
+-------------------------------------+------+-----------+------------+---------+---------------+------------------------------------------------------------+

---

[TestCommand_OCIImage/Scanning_Mageia_9_image - 2]

---

[TestCommand_OCIImage/Scanning_Ubuntu_image_with_go_OS_packages_json - 1]
Scanning local image tarball "./testdata/test-ubuntu-with-packages.tar"

Expand Down Expand Up @@ -3432,6 +3461,103 @@ Scanning local image tarball "./testdata/test-chisel.tar"

---

[TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image - 1]
{
"results": [
{
"source": {
"path": "/usr/share/python-wheels/pip-23.0.1-py3-none-any.whl",
"type": "artifact"
},
"packages": [
{
"package": {
"name": "pip",
"version": "23.0.1",
"ecosystem": "PyPI",
"image_origin_details": {
"index": 0
}
},
"groups": 6,
"vulnerabilities": [
"PYSEC-2023-228",
"PYSEC-2026-196",
"GHSA-4xh5-x5gv-qwph",
"GHSA-58qw-9mgm-455v",
"GHSA-6vgw-5pg2-w6jp",
"GHSA-jp4c-xjxw-mgf9",
"GHSA-mq26-g339-26xf"
]
}
]
},
{
"source": {
"path": "/usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl",
"type": "artifact"
},
"packages": [
{
"package": {
"name": "setuptools",
"version": "65.5.0",
"ecosystem": "PyPI",
"image_origin_details": {
"index": 0
}
},
"groups": 3,
"vulnerabilities": [
"PYSEC-2022-43012",
"PYSEC-2025-49",
"GHSA-5rjg-fvgr-3xxf",
"GHSA-cx63-2mw6-8hw5",
"GHSA-r9hx-vwmv-q579"
]
}
]
}
],
"experimental_config": {
"licenses": {
"summary": false,
"allowlist": null
}
},
"image_metadata": {
"os": "Mageia 9",
"layer_metadata": [
{
"diff_id": "sha256:...",
"command": "ADD rootfs.tar.xz / # buildkit",
"is_empty": false,
"base_image_index": 1
},
{
"diff_id": "",
"command": "CMD [/"/bin/bash/"]",
"is_empty": true,
"base_image_index": 1
}
],
"base_images": [
{},
{
"name": "mageia",
"tags": null
}
]
}
}

---

[TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image - 2]
Scanning local image tarball "./testdata/test-mageia-9.tar"

---

[TestCommand_OCIImage_JSONFormat/scanning_node_modules_using_npm_with_some_packages - 1]
{
"results": [
Expand Down
15 changes: 13 additions & 2 deletions cmd/osv-scanner/scan/image/command_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,8 +309,8 @@ func TestCommand_OCIImage(t *testing.T) {
Exit: 1,
},
{
Name: "scanning_image_with_go_binary",
Args: []string{"", "image", "--archive", "./testdata/test-package-tracing.tar"},
Name: "Scanning_Mageia_9_image",
Args: []string{"", "image", "--archive", "./testdata/test-mageia-9.tar"},
Exit: 1,
},
{
Expand Down Expand Up @@ -448,6 +448,17 @@ func TestCommand_OCIImage_JSONFormat(t *testing.T) {
testutility.AnyDiffID,
},
},
{
Name: "scanning_mageia_9_image",
Args: []string{"", "image", "--archive", "--format=json", "./testdata/test-mageia-9.tar"},
Exit: 1,
ReplaceRules: []testutility.JSONReplaceRule{
testutility.GroupsAsArrayLen,
testutility.OnlyIDVulnsRule,
testutility.OnlyFirstBaseImage,
testutility.AnyDiffID,
},
},
{
// This tests that the fzf go binary is not being reported because it's a OS package
Name: "ubuntu_image_with_go_OS_packages_json",
Expand Down
146 changes: 146 additions & 0 deletions cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3834,6 +3834,152 @@ interactions:
status: 200 OK
code: 200
duration: 0s
- request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 866
host: api.osv.dev
body: |
{
"queries": [
{
"package": {
"ecosystem": "PyPI",
"name": "pygobject"
},
"version": "3.44.1"
},
{
"package": {
"ecosystem": "PyPI",
"name": "gpg"
},
"version": "1.18.0"
},
{
"package": {
"ecosystem": "PyPI",
"name": "libcomps"
},
"version": "0.1.18"
},
{
"package": {
"ecosystem": "PyPI",
"name": "pip"
},
"version": "23.0.1"
},
{
"package": {
"ecosystem": "PyPI",
"name": "rpm"
},
"version": "4.18.2"
},
{
"package": {
"ecosystem": "PyPI",
"name": "setuptools"
},
"version": "65.5.0"
},
{
"package": {
"ecosystem": "PyPI",
"name": "six"
},
"version": "1.16.0"
}
]
}
headers:
Content-Type:
- application/json
X-Test-Name:
- TestCommand_OCIImage/Scanning_Mageia_9_image
url: https://api.osv.dev/v1/querybatch
method: POST
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: 873
body: |
{
"results": [
{},
{},
{},
{
"vulns": [
{
"id": "GHSA-4xh5-x5gv-qwph",
"modified": "2026-03-24T01:43:53.135277Z"
},
{
"id": "GHSA-58qw-9mgm-455v",
"modified": "2026-05-20T21:00:09.920997Z"
},
{
"id": "GHSA-6vgw-5pg2-w6jp",
"modified": "2026-03-24T01:43:46.425088Z"
},
{
"id": "GHSA-jp4c-xjxw-mgf9",
"modified": "2026-05-07T16:59:14.079020Z"
},
{
"id": "GHSA-mq26-g339-26xf",
"modified": "2026-03-24T01:43:05.410801Z"
},
{
"id": "PYSEC-2023-228",
"modified": "2026-03-24T01:42:37.905754Z"
},
{
"id": "PYSEC-2026-196",
"modified": "2026-06-05T12:45:14.124059Z"
}
]
},
{},
{
"vulns": [
{
"id": "GHSA-5rjg-fvgr-3xxf",
"modified": "2026-05-11T00:26:34.671259Z"
},
{
"id": "GHSA-cx63-2mw6-8hw5",
"modified": "2026-02-04T03:54:02.259111Z"
},
{
"id": "GHSA-r9hx-vwmv-q579",
"modified": "2026-02-04T03:03:25.892107Z"
},
{
"id": "PYSEC-2022-43012",
"modified": "2023-12-06T01:02:35.662444Z"
},
{
"id": "PYSEC-2025-49",
"modified": "2026-05-11T00:26:34.671259Z"
}
]
},
{}
]
}
headers:
Content-Length:
- "873"
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 0s
- request:
proto: HTTP/1.1
proto_major: 1
Expand Down
Loading
Loading