Repository: google/osv-scanner
Pull request #136 (2023-01-12 02:03:36)

Temporarily disable alpine package scanning
Temporarily disable alpine package scanning, see discussions in #128 for more context. 


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dae9235..56cd758 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,8 +4,7 @@ Upcoming release:
 This update adds support for NuGet and Alpine ecosystem, plus various bug fixes by the community.
 
 - [Feature #98](https://github.com/google/osv-scanner/pull/98): Support for NuGet ecosystem.
-- [Feature #107](https://github.com/google/osv-scanner/pull/107): Support for Alpine Linux `/lib/apk/db/installed` format.
-  - Adds `--check-installed-packages` flag to scan installed packages on Alpine Linux. 
+- [Bug #85](https://github.com/google/osv-scanner/issues/85): Even better support for narrow terminals by shortening osv.dev URLs.
 - [Bug #105](https://github.com/google/osv-scanner/issues/105): Fix rare cases of too many open file handles.
 - [Bug #131](https://github.com/google/osv-scanner/pull/131): Fix table highlighting overflow.
 
@@ -15,7 +14,7 @@ v1.0.2
 
 This is a minor patch release to mitigate human readable output issues on narrow terminals (#85).
 
-- [Bug #85](https://github.com/google/osv-scanner/issues/85): Mitigated by minor fixes.
+- [Bug #85](https://github.com/google/osv-scanner/issues/85): Better support for narrow terminals.
 
 
 v1.0.1
diff --git a/pkg/lockfile/ecosystems.go b/pkg/lockfile/ecosystems.go
index ec7c101..b4f456d 100644
--- a/pkg/lockfile/ecosystems.go
+++ b/pkg/lockfile/ecosystems.go
@@ -12,6 +12,8 @@ func KnownEcosystems() []Ecosystem {
 		MavenEcosystem,
 		PipEcosystem,
 		PubEcosystem,
-		AlpineEcosystem,
+		// Disabled temporarily,
+		// see https://github.com/google/osv-scanner/pull/128 discussion for additional context
+		// AlpineEcosystem,
 	}
 }
diff --git a/pkg/lockfile/parse.go b/pkg/lockfile/parse.go
index 579b10c..3a34b22 100644
--- a/pkg/lockfile/parse.go
+++ b/pkg/lockfile/parse.go
@@ -24,7 +24,6 @@ var parsers = map[string]PackageDetailsParser{
 	"Gemfile.lock":                ParseGemfileLock,
 	"go.mod":                      ParseGoLock,
 	"gradle.lockfile":             ParseGradleLock,
-        "installed":                   ParseApkInstalled,
 	"mix.lock":                    ParseMixLock,
 	"Pipfile.lock":                ParsePipenvLock,
 	"package-lock.json":           ParseNpmLock,


Test patch:
diff --git a/pkg/lockfile/parse-apk-installed.go b/pkg/lockfile/apk-installed.go
similarity index 100%
rename from pkg/lockfile/parse-apk-installed.go
rename to pkg/lockfile/apk-installed.go
diff --git a/pkg/lockfile/parse-apk-installed_test.go b/pkg/lockfile/apk-installed_test.go
similarity index 99%
rename from pkg/lockfile/parse-apk-installed_test.go
rename to pkg/lockfile/apk-installed_test.go
index 1b38774..4bfbc1c 100644
--- a/pkg/lockfile/parse-apk-installed_test.go
+++ b/pkg/lockfile/apk-installed_test.go
@@ -1,8 +1,9 @@
 package lockfile_test
 
 import (
-	"github.com/google/osv-scanner/pkg/lockfile"
 	"testing"
+
+	"github.com/google/osv-scanner/pkg/lockfile"
 )
 
 func TestParseApkInstalled_FileDoesNotExist(t *testing.T) {
diff --git a/pkg/lockfile/parse_test.go b/pkg/lockfile/parse_test.go
index 1a1acb6..9bf9cad 100644
--- a/pkg/lockfile/parse_test.go
+++ b/pkg/lockfile/parse_test.go
@@ -43,20 +43,20 @@ func TestFindParser(t *testing.T) {
 	lockfiles := []string{
 		"buildscript-gradle.lockfile",
 		"Cargo.lock",
-		"package-lock.json",
-		"packages.lock.json",
-		"yarn.lock",
-		"pnpm-lock.yaml",
 		"composer.lock",
 		"Gemfile.lock",
 		"go.mod",
 		"gradle.lockfile",
 		"mix.lock",
-		"pom.xml",
+		"Pipfile.lock",
+		"package-lock.json",
+		"packages.lock.json",
+		"pnpm-lock.yaml",
 		"poetry.lock",
+		"pom.xml",
 		"pubspec.lock",
 		"requirements.txt",
-		"Pipfile.lock",
+		"yarn.lock",
 	}
 
 	for _, file := range lockfiles {
@@ -92,21 +92,20 @@ func TestParse_FindsExpectedParsers(t *testing.T) {
 	lockfiles := []string{
 		"buildscript-gradle.lockfile",
 		"Cargo.lock",
-		"package-lock.json",
-		"packages.lock.json",
-		"yarn.lock",
-		"pnpm-lock.yaml",
 		"composer.lock",
 		"Gemfile.lock",
 		"go.mod",
 		"gradle.lockfile",
 		"mix.lock",
 		"Pipfile.lock",
-		"pom.xml",
+		"package-lock.json",
+		"packages.lock.json",
+		"pnpm-lock.yaml",
 		"poetry.lock",
+		"pom.xml",
 		"pubspec.lock",
 		"requirements.txt",
-		"installed",
+		"yarn.lock",
 	}
 
 	count := 0