test: add E2E test for openSUSE Leap ecosystem mapping#2937
Open
herdiyana256 wants to merge 2 commits into
Open
test: add E2E test for openSUSE Leap ecosystem mapping#2937herdiyana256 wants to merge 2 commits into
herdiyana256 wants to merge 2 commits into
Conversation
Adds a pinned opensuse/leap:15.5 image fixture and scan-image test cases (plain + JSON format), following the same pattern used for the AlmaLinux (google#2870) and Mageia (google#2873) ecosystem E2E tests. Depends on the openSUSE Leap ecosystem mapping fix that just merged in google/osv-scalibr#2290 (closes google/osv-scalibr#2203).
…ckages The image scan's default "artifact" preset wired up apk, dpkg, chisel, and homebrew, but never the rpm extractor, so RPM-based images (AlmaLinux, RHEL, Rocky, Mageia, openSUSE Leap, ...) produced zero inventory. This is the same root cause already fixed for AlmaLinux in PR google#2870 (f995ea5), which hasn't landed on main yet; registering it here so the new openSUSE Leap E2E test (and RPM-based scanning in general) actually detects packages instead of failing with "No package sources found". Also points go.mod at a branch of the osv-scalibr fork carrying just the openSUSE Leap ecosystem mapping fix (google/osv-scalibr#2290) cherry-picked onto the same osv-scalibr version already used by the AlmaLinux/Mageia branches, since bumping straight to the latest osv-scalibr main pulls in unrelated breaking API changes. Same temporary-replace pattern used while google#2250 was in flight; drop once osv-scanner's own osv-scalibr bump catches up. Updates snapshots/cassettes across scan/image, scan/source, output, and scalibrplugin affected by rpm now being a registered extractor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an end-to-end test for the openSUSE Leap ecosystem mapping fix that just merged in google/osv-scalibr#2290 (closes google/osv-scalibr#2203), following the same pattern used for the AlmaLinux (#2870) and Mageia (#2873) ecosystem E2E tests.
opensuse/leap:15.5image fixture (test-opensuse-leap-15.5.Dockerfile).Scanning_openSUSE_Leap_15.5_image/scanning_opensuse_leap_15.5_imagecases toTestCommand_OCIImageandTestCommand_OCIImage_JSONFormat, with recorded cassette entries and snapshots showing real SUSE-SU advisories detected forcurlandopenssl-1_1.While wiring this up I found the
os/rpmextractor was never registered in theartifactpreset used by image scanning (internal/scalibrplugin/presets.go), so any RPM-based image, not just openSUSE Leap, currently scans with zero package inventory ("No package sources found"). This is the same root cause already fixed for AlmaLinux in #2870 (commit f995ea5), which hasn't landed onmainyet, so I included the same registration here to unblock this test. Updated the snapshots/cassettes it touches (scan/source,internal/output,internal/scalibrplugin).go.modpoints at a branch on my osv-scalibr fork carrying just the openSUSE Leap ecosystem fix cherry-picked onto the same osv-scalibr base already used by the AlmaLinux/Mageia branches. Bumping straight to the latest osv-scalibrmainpulls in unrelated breaking API changes (PluginConfigrefactor, Maven client signature changes, etc.) that osv-scanner hasn't absorbed yet. This is the same temporary-replace pattern used while #2250 was in flight; happy to drop it once either this or the AlmaLinux/Mageia scalibr bump lands.Test plan
go build ./...: cleango test ./... -short: all packages passTEST_ACCEPTANCE=true go test ./cmd/osv-scanner/scan/image/... -run 'TestCommand_OCIImage$|TestCommand_OCIImage_JSONFormat$': all pass, including the new openSUSE Leap casescurl 8.0.1-150400.5.50.1matchesSUSE-SU-2024:3926-1andSUSE-SU-2024:4359-1;openssl-1_1 1.1.1l-150500.17.34.1matchesSUSE-SU-2024:3765-1; ecosystemopenSUSE:Leap 15.5; base imageopensuse/leapcorrectly detected.cc @Ly-Joey: this follows up on your review request on google/osv-scalibr#2290 to add E2E coverage for the openSUSE Leap ecosystem mapping.