Search /usr/share for rpmdb to fix scan on ostree-managed images (#1756)

Fixes: #1755 Signed-off-by: Filip Pytloun <filip@pytloun.cz> Co-authored-by: Alex Goodman <alex.goodman@anchore.com>
anchore · May 2, 2023 · 95a04ca · 95a04ca
1 parent dd458a2
commit 95a04ca
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 1 deletion.
diff --git a/syft/pkg/cataloger/rpm/cataloger_test.go b/syft/pkg/cataloger/rpm/cataloger_test.go
@@ -16,6 +16,9 @@ func Test_DBCataloger_Globs(t *testing.T) {
 			name:    "obtain DB files",
 			fixture: "test-fixtures/glob-paths",
 			expected: []string{
+				"usr/share/rpm/Packages",
+				"usr/share/rpm/Packages.db",
+				"usr/share/rpm/rpmdb.sqlite",
 				"var/lib/rpm/Packages",
 				"var/lib/rpm/Packages.db",
 				"var/lib/rpm/rpmdb.sqlite",

diff --git a/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages
@@ -0,0 +1 @@
+bogus
diff --git a/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages.db b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/Packages.db
@@ -0,0 +1 @@
+bogus
diff --git a/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/rpmdb.sqlite b/syft/pkg/cataloger/rpm/test-fixtures/glob-paths/usr/share/rpm/rpmdb.sqlite
@@ -0,0 +1 @@
+bogus
diff --git a/syft/pkg/rpm_metadata.go b/syft/pkg/rpm_metadata.go
@@ -8,10 +8,12 @@ import (
 	"github.com/anchore/syft/syft/file"
 )
 
+// /var/lib/rpm/... is the typical path for most distributions
+// /usr/share/rpm/... is common for rpm-ostree distributions (coreos-like)
 // Packages is the legacy Berkely db based format
 // Packages.db is the "ndb" format used in SUSE
 // rpmdb.sqlite is the sqlite format used in fedora + derivates
-const RpmDBGlob = "**/var/lib/rpm/{Packages,Packages.db,rpmdb.sqlite}"
+const RpmDBGlob = "**/{var/lib,usr/share}/rpm/{Packages,Packages.db,rpmdb.sqlite}"
 
 // Used in CBL-Mariner distroless images
 const RpmManifestGlob = "**/var/lib/rpmmanifest/container-manifest-2"