Repository navigation
extractor/os/rpm: add openSUSE Leap ecosystem mapping - #2290
Merged
copybara-service[bot] merged 1 commit intoJul 21, 2026
Merged
Conversation
Contributor
Author
|
@another-rex Just pushed a merge to resolve the conflicts with main (Mageia ecosystem landed in the meantime, so I merged both cases into ecosystem.go/ecosystem_test.go side by side). All existing tests plus the new openSUSE Leap cases pass. Ready for review whenever you have a chance. |
Ly-Joey
approved these changes
Jul 21, 2026
Collaborator
There was a problem hiding this comment.
Hi @herdiyana256 thank you for the contribution and your patience, the change LGTM!
Could you please also add some end-to-end tests to osv-scanner? (Like you did with AlmaLinux and Mageia)
Once this branch is rebased to resolve existing merge conflicts, I'll get to merging the PR.
Thanks again!
ID=opensuse-leap from /etc/os-release fell through the rpmmeta.Metadata
switch with no case, producing an empty ecosystem string and making all
12,954 openSUSE OSV advisories unreachable.
Add a dedicated branch that constructs the suffix as "Leap " + VERSION_ID,
matching the format used by OSV.dev (e.g. "openSUSE:Leap 15.5").
Using VERSION_ID alone ("15.5") does not match any advisory.
The EcosystemOpenSUSE constant was already defined in
inventory/osvecosystem/parsed.go but never referenced in ecosystem.go.
Fixes: google#2203
herdiyana256
force-pushed
the
fix/opensuse-leap-ecosystem
branch
from
July 21, 2026 13:27
0caaa7f to
1d0902b
Compare
Contributor
Author
|
@Ly-Joey Rebased onto latest main - conflicts resolved, branch is now a single clean commit. All 18 checks are green. Ready to merge whenever you get a chance, thanks! |
4 tasks done
another-rex
added a commit
to google/osv-scanner
that referenced
this pull request
Aug 7, 2026
## Summary Adds an end-to-end test for the openSUSE Leap ecosystem mapping fix that just merged in [google/osv-scalibr#2290](google/osv-scalibr#2290) (closes [google/osv-scalibr#2203](google/osv-scalibr#2203)), following the same pattern used for the AlmaLinux (#2870) and Mageia (#2873) ecosystem E2E tests. - Adds a pinned `opensuse/leap:15.5` image fixture (`test-opensuse-leap-15.5.Dockerfile`). - Adds `Scanning_openSUSE_Leap_15.5_image` / `scanning_opensuse_leap_15.5_image` cases to `TestCommand_OCIImage` and `TestCommand_OCIImage_JSONFormat`, with recorded cassette entries and snapshots showing real SUSE-SU advisories detected for `curl` and `openssl-1_1`. While wiring this up I found the `os/rpm` extractor was never registered in the `artifact` preset used by image scanning (`internal/scalibrplugin/presets.go`), so any RPM-based image, not just openSUSE Leap, currently scans with zero package inventory ("No package sources found"). This is the same root cause already fixed for AlmaLinux in #2870 (commit f995ea5), which hasn't landed on `main` yet, so I included the same registration here to unblock this test. Updated the snapshots/cassettes it touches (`scan/source`, `internal/output`, `internal/scalibrplugin`). `go.mod` points at a branch on my osv-scalibr fork carrying just the openSUSE Leap ecosystem fix cherry-picked onto the same osv-scalibr base already used by the AlmaLinux/Mageia branches. Bumping straight to the latest osv-scalibr `main` pulls in unrelated breaking API changes (`PluginConfig` refactor, Maven client signature changes, etc.) that osv-scanner hasn't absorbed yet. This is the same temporary-replace pattern used while #2250 was in flight; happy to drop it once either this or the AlmaLinux/Mageia scalibr bump lands. ## Test plan - [x] `go build ./...`: clean - [x] `go test ./... -short`: all packages pass - [x] `TEST_ACCEPTANCE=true go test ./cmd/osv-scanner/scan/image/... -run 'TestCommand_OCIImage$|TestCommand_OCIImage_JSONFormat$'`: all pass, including the new openSUSE Leap cases - [x] Verified the JSON snapshot shows real detections: `curl 8.0.1-150400.5.50.1` matches `SUSE-SU-2024:3926-1` and `SUSE-SU-2024:4359-1`; `openssl-1_1 1.1.1l-150500.17.34.1` matches `SUSE-SU-2024:3765-1`; ecosystem `openSUSE:Leap 15.5`; base image `opensuse/leap` correctly detected. cc @Ly-Joey: this follows up on your review request on google/osv-scalibr#2290 to add E2E coverage for the openSUSE Leap ecosystem mapping. --------- Co-authored-by: Rex P <[email protected]> Co-authored-by: Rex P <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ID=opensuse-leapfrom/etc/os-releasehad no case in the*rpmmeta.Metadataswitch inecosystem.go. It fell through withnamespace = "", producing an empty ecosystem string. As a result, none of the 12,954 openSUSE advisories tracked on OSV.dev were ever reachable for any openSUSE Leap container scan.Closes #2203.
Root cause
The
MakeEcosystemfunction handlesrhel,rocky,openEuler, andalmalinuxexplicitly before falling through to the generic namespace path.opensuse-leapwas not included, so the namespace remained""and the ecosystem was never set.EcosystemOpenSUSEwas already defined ininventory/osvecosystem/parsed.gobut never referenced inecosystem.go.Fix
Added one
ifbranch forOSID == "opensuse-leap"that constructs the suffix as"Leap " + m.OSVersionID. This matches the format used by OSV.dev for openSUSE advisories (e.g.openSUSE:Leap 15.5). UsingVERSION_IDalone ("15.5") does not match any advisory.When
VERSION_IDis absent, the function returns the base ecosystem without suffix viaosvecosystem.FromEcosystem.Verification
Verified against OSV.dev API:
openSUSE:Leap 15.5returns SUSE-SU advisories for curl, openssl, and others.openSUSE:Leap 15.3andopenSUSE:Leap 15.4match SUSE-SU-2022:1657-1 (curl, High severity).openSUSE:15.5(no "Leap" prefix) returns zero results.Confirmed
/etc/os-releaseonopensuse/leap:15.5:All existing
TestEcosystemRPMcases continue to pass. New test cases added for Leap 15.3, 15.4, 15.5, and the no-version edge case.Files changed
extractor/filesystem/os/ecosystem/ecosystem.go: addopensuse-leapcaseextractor/filesystem/os/ecosystem/ecosystem_test.go: add four test cases for openSUSE Leap