Repository: anchore/grype
Pull request #2069 (2024-08-20 11:03:50)

chore: bump quality gate vuln match labels data


Patch:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index db8fb228..fc316e79 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -63,7 +63,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
+      uses: github/codeql-action/init@883d8588e56d1753a8a58c1c86e88976f0c23449 # v3.26.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -85,4 +85,4 @@ jobs:
       run: make grype
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
+      uses: github/codeql-action/analyze@883d8588e56d1753a8a58c1c86e88976f0c23449 # v3.26.3
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 74b933eb..9881ee2e 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -38,6 +38,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v1.0.26
+        uses: github/codeql-action/upload-sarif@883d8588e56d1753a8a58c1c86e88976f0c23449 # v1.0.26
         with:
           sarif_file: results.sarif
diff --git a/cmd/grype/cli/options/database.go b/cmd/grype/cli/options/database.go
index 23e47997..986cfab2 100644
--- a/cmd/grype/cli/options/database.go
+++ b/cmd/grype/cli/options/database.go
@@ -12,16 +12,17 @@ import (
 )
 
 type Database struct {
-	Dir                    string        `yaml:"cache-dir" json:"cache-dir" mapstructure:"cache-dir"`
-	UpdateURL              string        `yaml:"update-url" json:"update-url" mapstructure:"update-url"`
-	CACert                 string        `yaml:"ca-cert" json:"ca-cert" mapstructure:"ca-cert"`
-	AutoUpdate             bool          `yaml:"auto-update" json:"auto-update" mapstructure:"auto-update"`
-	ValidateByHashOnStart  bool          `yaml:"validate-by-hash-on-start" json:"validate-by-hash-on-start" mapstructure:"validate-by-hash-on-start"`
-	ValidateAge            bool          `yaml:"validate-age" json:"validate-age" mapstructure:"validate-age"`
-	MaxAllowedBuiltAge     time.Duration `yaml:"max-allowed-built-age" json:"max-allowed-built-age" mapstructure:"max-allowed-built-age"`
-	RequireUpdateCheck     bool          `yaml:"require-update-check" json:"require-update-check" mapstructure:"require-update-check"`
-	UpdateAvailableTimeout time.Duration `yaml:"update-available-timeout" json:"update-available-timeout" mapstructure:"update-available-timeout"`
-	UpdateDownloadTimeout  time.Duration `yaml:"update-download-timeout" json:"update-download-timeout" mapstructure:"update-download-timeout"`
+	ID                     clio.Identification `yaml:"-" json:"-" mapstructure:"-"`
+	Dir                    string              `yaml:"cache-dir" json:"cache-dir" mapstructure:"cache-dir"`
+	UpdateURL              string              `yaml:"update-url" json:"update-url" mapstructure:"update-url"`
+	CACert                 string              `yaml:"ca-cert" json:"ca-cert" mapstructure:"ca-cert"`
+	AutoUpdate             bool                `yaml:"auto-update" json:"auto-update" mapstructure:"auto-update"`
+	ValidateByHashOnStart  bool                `yaml:"validate-by-hash-on-start" json:"validate-by-hash-on-start" mapstructure:"validate-by-hash-on-start"`
+	ValidateAge            bool                `yaml:"validate-age" json:"validate-age" mapstructure:"validate-age"`
+	MaxAllowedBuiltAge     time.Duration       `yaml:"max-allowed-built-age" json:"max-allowed-built-age" mapstructure:"max-allowed-built-age"`
+	RequireUpdateCheck     bool                `yaml:"require-update-check" json:"require-update-check" mapstructure:"require-update-check"`
+	UpdateAvailableTimeout time.Duration       `yaml:"update-available-timeout" json:"update-available-timeout" mapstructure:"update-available-timeout"`
+	UpdateDownloadTimeout  time.Duration       `yaml:"update-download-timeout" json:"update-download-timeout" mapstructure:"update-download-timeout"`
 }
 
 var _ interface {
@@ -36,6 +37,7 @@ const (
 
 func DefaultDatabase(id clio.Identification) Database {
 	return Database{
+		ID:          id,
 		Dir:         path.Join(xdg.CacheHome, id.Name, "db"),
 		UpdateURL:   internal.DBUpdateURL,
 		AutoUpdate:  true,
@@ -50,6 +52,7 @@ func DefaultDatabase(id clio.Identification) Database {
 
 func (cfg Database) ToCuratorConfig() db.Config {
 	return db.Config{
+		ID:                  cfg.ID,
 		DBRootDir:           cfg.Dir,
 		ListingURL:          cfg.UpdateURL,
 		CACert:              cfg.CACert,
diff --git a/go.mod b/go.mod
index 6949e4a7..11d4c301 100644
--- a/go.mod
+++ b/go.mod
@@ -14,7 +14,7 @@ require (
 	github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4
 	github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f
 	github.com/anchore/stereoscope v0.0.3-0.20240725180315-50ce3be7aa1f
-	github.com/anchore/syft v1.11.0
+	github.com/anchore/syft v1.11.1
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
 	github.com/bmatcuk/doublestar/v2 v2.0.4
 	github.com/charmbracelet/bubbletea v0.27.0
diff --git a/go.sum b/go.sum
index 95089a31..fa04cd69 100644
--- a/go.sum
+++ b/go.sum
@@ -257,8 +257,8 @@ github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f h1:B/E9ixK
 github.com/anchore/packageurl-go v0.1.1-0.20240507183024-848e011fc24f/go.mod h1:Blo6OgJNiYF41ufcgHKkbCKF2MDOMlrqhXv/ij6ocR4=
 github.com/anchore/stereoscope v0.0.3-0.20240725180315-50ce3be7aa1f h1:xuBvotcht1Ns8IdaC4UuYV1U8MFln9c5ELeo5bzDEO8=
 github.com/anchore/stereoscope v0.0.3-0.20240725180315-50ce3be7aa1f/go.mod h1:DcQdMes8SwpFli3rDH0v+Vd9qU9Jariq7JSHNJV5X/A=
-github.com/anchore/syft v1.11.0 h1:tpXYD87J3BmT5tbsiRH6xHpotIBPSjen96ZuZJ/KvKY=
-github.com/anchore/syft v1.11.0/go.mod h1:6tncG8qg5G30c6duuBkA3Qo2v3uiKkGJ/tHUPQUsn/4=
+github.com/anchore/syft v1.11.1 h1:uJVmZ1WuhMw2cutCsBj0aUgUZxaNlbBNimZEISFttWY=
+github.com/anchore/syft v1.11.1/go.mod h1:iwb+87tx6Fg2+1bzKEzgNcaBS6zjFSx59uraw24xtIY=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
diff --git a/grype/db/curator.go b/grype/db/curator.go
index 0c5c1dd0..7af7d341 100644
--- a/grype/db/curator.go
+++ b/grype/db/curator.go
@@ -17,6 +17,7 @@ import (
 	partybus "github.com/wagoodman/go-partybus"
 	progress "github.com/wagoodman/go-progress"
 
+	"github.com/anchore/clio"
 	grypeDB "github.com/anchore/grype/grype/db/v5"
 	"github.com/anchore/grype/grype/db/v5/store"
 	"github.com/anchore/grype/grype/event"
@@ -31,6 +32,7 @@ const (
 )
 
 type Config struct {
+	ID                  clio.Identification
 	DBRootDir           string
 	ListingURL          string
 	CACert              string
@@ -75,8 +77,8 @@ func NewCurator(cfg Config) (Curator, error) {
 	return Curator{
 		fs:                  fs,
 		targetSchema:        vulnerability.SchemaVersion,
-		listingDownloader:   file.NewGetter(listingClient),
-		updateDownloader:    file.NewGetter(dbClient),
+		listingDownloader:   file.NewGetter(cfg.ID, listingClient),
+		updateDownloader:    file.NewGetter(cfg.ID, dbClient),
 		dbDir:               dbDir,
 		dbPath:              path.Join(dbDir, FileName),
 		listingURL:          cfg.ListingURL,
diff --git a/internal/file/getter.go b/internal/file/getter.go
index 216a0965..12d765f5 100644
--- a/internal/file/getter.go
+++ b/internal/file/getter.go
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/go-getter/helper/url"
 	"github.com/wagoodman/go-progress"
 
+	"github.com/anchore/clio"
 	"github.com/anchore/grype/internal/stringutil"
 )
 
@@ -32,10 +33,13 @@ type HashiGoGetter struct {
 
 // NewGetter creates and returns a new Getter. Providing an http.Client is optional. If one is provided,
 // it will be used for all HTTP(S) getting; otherwise, go-getter's default getters will be used.
-func NewGetter(httpClient *http.Client) *HashiGoGetter {
+func NewGetter(id clio.Identification, httpClient *http.Client) *HashiGoGetter {
 	return &HashiGoGetter{
 		httpGetter: getter.HttpGetter{
 			Client: httpClient,
+			Header: http.Header{
+				"User-Agent": []string{fmt.Sprintf("%v %v", id.Name, id.Version)},
+			},
 		},
 	}
 }


Test patch:
diff --git a/cmd/grype/cli/commands/listing_test.go b/cmd/grype/cli/commands/listing_test.go
new file mode 100644
index 00000000..fa879f3d
--- /dev/null
+++ b/cmd/grype/cli/commands/listing_test.go
@@ -0,0 +1,41 @@
+package commands
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/anchore/clio"
+)
+
+func Test_ListingUserAgent(t *testing.T) {
+	listingFile := "/listing.json"
+
+	got := ""
+
+	// setup mock
+	handler := http.NewServeMux()
+	handler.HandleFunc(listingFile, func(w http.ResponseWriter, r *http.Request) {
+		got = r.Header.Get("User-Agent")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("1.0.0"))
+	})
+	mockSrv := httptest.NewServer(handler)
+	defer mockSrv.Close()
+
+	dbOptions := *dbOptionsDefault(clio.Identification{
+		Name:    "the-app",
+		Version: "v3.2.1",
+	})
+	dbOptions.DB.RequireUpdateCheck = true
+	dbOptions.DB.UpdateURL = mockSrv.URL + listingFile
+
+	_ = runDBList(&dbListOptions{
+		Output:    "",
+		DBOptions: dbOptions,
+	})
+
+	if got != "the-app v3.2.1" {
+		t.Errorf("expected User-Agent header to match, got: %v", got)
+	}
+}
diff --git a/internal/file/getter_test.go b/internal/file/getter_test.go
index f0bdaf90..a8f47ce8 100644
--- a/internal/file/getter_test.go
+++ b/internal/file/getter_test.go
@@ -14,6 +14,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+
+	"github.com/anchore/clio"
 )
 
 func TestGetter_GetFile(t *testing.T) {
@@ -45,7 +47,7 @@ func TestGetter_GetFile(t *testing.T) {
 				tc.prepareClient(httpClient)
 			}
 
-			getter := NewGetter(httpClient)
+			getter := NewGetter(testID, httpClient)
 			requestURL := createRequestURL(t, server, requestPath)
 
 			tempDir := t.TempDir()
@@ -72,7 +74,7 @@ func TestGetter_GetToDir_FilterNonArchivesWired(t *testing.T) {
 
 	for _, test := range testCases {
 		t.Run(test.name, func(t *testing.T) {
-			test.assert(t, NewGetter(nil).GetToDir(t.TempDir(), test.source))
+			test.assert(t, NewGetter(testID, nil).GetToDir(t.TempDir(), test.source))
 		})
 	}
 }
@@ -138,7 +140,7 @@ func TestGetter_GetToDir_CertConcerns(t *testing.T) {
 				tc.prepareClient(httpClient)
 			}
 
-			getter := NewGetter(httpClient)
+			getter := NewGetter(testID, httpClient)
 			requestURL := createRequestURL(t, server, requestPath)
 
 			tempDir := t.TempDir()
@@ -193,6 +195,11 @@ func withResponseForPath(t *testing.T, path string, response []byte) muxOption {
 	}
 }
 
+var testID = clio.Identification{
+	Name:    "test-app",
+	Version: "v0.5.3",
+}
+
 func newTestServer(t *testing.T, muxOptions ...muxOption) *httptest.Server {
 	t.Helper()
 
diff --git a/test/quality/vulnerability-match-labels b/test/quality/vulnerability-match-labels
index a8721b18..8ad561f7 160000
--- a/test/quality/vulnerability-match-labels
+++ b/test/quality/vulnerability-match-labels
@@ -1,1 +1,1 @@
-Subproject commit a8721b180fcea164460ae60d852ea5607a56005b
+Subproject commit 8ad561f7eee84ebf3026812dd6f945946a1faa31