fix(binary): detect grafana security-patch release versions - #5213
Open
pujitha24 wants to merge 2 commits into
Open
fix(binary): detect grafana security-patch release versions#5213pujitha24 wants to merge 2 commits into
pujitha24 wants to merge 2 commits into
Conversation
Motivation: Syft reports grafana binaries built from security-patch tags (e.g. grafana/grafana:11.0.5-security-01, 12.0.0-security-01, and 12.4.3-security-02 on arm/v7) as version UNKNOWN. These binaries embed the version as a standalone Go string constant (e.g. "11.0.5+security-01") with no "release-" prefix, and on at least the arm/v7 build the "release-<version>+security-NN" string that does exist nearby is preceded by non-NUL padding bytes, so none of the existing grafana-binary regexes (which all require either a "release-" prefix preceded by NUL bytes, or other markers like "go1.x"/"/usr/local/go"/"$a") match. Approach: Add an additional EvidenceMatcher pattern to the "**/grafana" classifier that matches the raw "<version>+security-NN" constant directly, bounded only by a single NUL byte on each side. This mirrors how the binary actually lays out this string and does not depend on the "release-" prefix or any other nearby marker, so it also covers the arm/v7 case where that prefix is present but not NUL-padded. Validation: Added snippet fixtures (extracted from the real grafana/grafana security-patch images) and test cases for 11.0.5-security-01 and 12.0.0-security-01 (linux/amd64) and 12.4.3-security-02 (linux/arm), confirming these match the exact "UNKNOWN version" repro from the report. Ran: go test ./syft/pkg/cataloger/binary/... -run Test_Cataloger_PositiveCases/grafana All grafana subtests pass. Verified the new tests are a real regression check by reverting classifiers.go alone and re-running: the three new subtests fail with "should have 1 item(s), but has 0" (no package/version detected), confirming they fail before this fix and pass after it. Also ran `go build ./...` and `golangci-lint run ./syft/pkg/cataloger/binary/...`, both clean (pre-existing goconst findings elsewhere in the file are unrelated to this change). `go generate ./internal/capabilities` produces no diff since no new classifier or package was added. This does not address the second part of the report (arm dev-build images like grafana-oss-dev showing an unrelated "3.39.4" binary version) -- that appears to be a separate false-positive match against different embedded data and needs its own investigation. Report: anchore#5059 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Assisted-by: claude-sonnet-5 (via Claude Code)
wagoodman
approved these changes
Aug 21, 2026
wagoodman
enabled auto-merge (squash)
August 21, 2026 21:03
The fixture-download tool matches platforms as OS/Architecture only and never consults the manifest variant field, so linux/arm/v7 can never match. Use linux/arm, matching the convention already used elsewhere in this file (e.g. nginx-ingress-controller) for arm/v7 binaries. Fixes the failing Unit tests CI check on anchore#5213 (refresh-fixtures/build-fixtures docker pull failure). Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
auto-merge was automatically disabled
August 21, 2026 21:39
Head branch was pushed to by a user without write access
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Grafana binaries built from "security patch" release tags (e.g.
grafana/grafana:11.0.5-security-01,12.0.0-security-01, and12.4.3-security-02on arm/v7) are reported by syft as versionUNKNOWN. These binaries embed the version as a standalone Go string constant (e.g.11.0.5+security-01) with norelease-prefix, and on at least the arm/v7 build therelease-<version>+security-NNstring that does exist nearby is preceded by non-NUL padding bytes, so none of the existinggrafana-binaryregexes (which all require either arelease-prefix preceded by NUL bytes, or other markers likego1.x//usr/local/go/$a) match.Before:
After (verified against the extracted binary via the added unit test, not a live
syftrun against the image):This adds one additional
EvidenceMatcherregex alternative to the existing**/grafanaclassifier insyft/pkg/cataloger/binary/classifiers.gothat matches the raw<version>+security-NNconstant directly, bounded only by a single NUL byte on each side. This mirrors how the binary actually lays out this string and does not depend on therelease-prefix or any other nearby marker, so it also covers the arm/v7 case where that prefix is present but not NUL-padded. No application/API configuration changed.This does not address the second part of the linked report (arm dev-build images like
grafana-oss-devshowing an unrelated3.39.4binary version) — that appears to be a separate false-positive match against different embedded data and needs its own investigation.Type of change
Checklist
Issue references
Fixes #5059