fix: correct invalid MD5 hashes for rpms ending with one or more zero…

… bytes (#5393)
aquasecurity · Oct 19, 2023 · e5317c7 · e5317c7
1 parent 9fba79f
commit e5317c7
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/go.mod b/go.mod
@@ -58,7 +58,7 @@ require (
 	github.com/knqyf263/go-apk-version v0.0.0-20200609155635-041fdbb8563f
 	github.com/knqyf263/go-deb-version v0.0.0-20230223133812-3ed183d23422
 	github.com/knqyf263/go-rpm-version v0.0.0-20220614171824-631e686d1075
-	github.com/knqyf263/go-rpmdb v0.0.0-20230517124904-b97c85e63254
+	github.com/knqyf263/go-rpmdb v0.0.0-20231008124120-ac49267ab4e1
 	github.com/knqyf263/nested v0.0.1
 	github.com/kylelemons/godebug v1.1.0
 	github.com/magefile/mage v1.15.0

diff --git a/go.sum b/go.sum
@@ -1217,8 +1217,8 @@ github.com/knqyf263/go-deb-version v0.0.0-20230223133812-3ed183d23422 h1:PPPlUUq
 github.com/knqyf263/go-deb-version v0.0.0-20230223133812-3ed183d23422/go.mod h1:ijAmSS4jErO6+KRzcK6ixsm3Vt96hMhJ+W+x+VmbrQA=
 github.com/knqyf263/go-rpm-version v0.0.0-20220614171824-631e686d1075 h1:aC6MEAs3PE3lWD7lqrJfDxHd6hcced9R4JTZu85cJwU=
 github.com/knqyf263/go-rpm-version v0.0.0-20220614171824-631e686d1075/go.mod h1:i4sF0l1fFnY1aiw08QQSwVAFxHEm311Me3WsU/X7nL0=
-github.com/knqyf263/go-rpmdb v0.0.0-20230517124904-b97c85e63254 h1:sWdRcroy0oENkvpa1jH7g8KyN7jBFsooMNlFrAvpI5I=
-github.com/knqyf263/go-rpmdb v0.0.0-20230517124904-b97c85e63254/go.mod h1:9LQcoMCMQ9vrF7HcDtXfvqGO4+ddxFQ8+YF/0CVGDww=
+github.com/knqyf263/go-rpmdb v0.0.0-20231008124120-ac49267ab4e1 h1:lrciwn7tj0j7HS5DfpAFnFZEqxzPGIkVOVS89dLOkf0=
+github.com/knqyf263/go-rpmdb v0.0.0-20231008124120-ac49267ab4e1/go.mod h1:9LQcoMCMQ9vrF7HcDtXfvqGO4+ddxFQ8+YF/0CVGDww=
 github.com/knqyf263/nested v0.0.1 h1:Sv26CegUMhjt19zqbBKntjwESdxe5hxVPSk0+AKjdUc=
 github.com/knqyf263/nested v0.0.1/go.mod h1:zwhsIhMkBg90DTOJQvxPkKIypEHPYkgWHs4gybdlUmk=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=

diff --git a/pkg/fanal/analyzer/pkg/rpm/rpm_test.go b/pkg/fanal/analyzer/pkg/rpm/rpm_test.go
@@ -74,7 +74,7 @@ func TestParseRpmInfo(t *testing.T) {
 				{Name: "libusbx", Epoch: 0, Version: "1.0.22", Release: "1.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:0a5650b09182d2b0134ee832acd5432e", SrcName: "libusbx", SrcEpoch: 0, SrcVersion: "1.0.22", SrcRelease: "1.fc28"},
 				{Name: "libsemanage", Epoch: 0, Version: "2.8", Release: "2.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:5c29e3e9ed089e3fedf7298dabe503fd", SrcName: "libsemanage", SrcEpoch: 0, SrcVersion: "2.8", SrcRelease: "2.fc28"},
 				{Name: "libutempter", Epoch: 0, Version: "1.1.6", Release: "14.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:ccfd737faad3d1be60f4c21839f5a9af", SrcName: "libutempter", SrcEpoch: 0, SrcVersion: "1.1.6", SrcRelease: "14.fc28"},
-				{Name: "mpfr", Epoch: 0, Version: "3.1.6", Release: "1.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv3+ and GPLv3+ and GFDL"}, Maintainer: "Fedora Project", Digest: "md5:a1339297aae3e31e8e1b1de00f7930", SrcName: "mpfr", SrcEpoch: 0, SrcVersion: "3.1.6", SrcRelease: "1.fc28"},
+				{Name: "mpfr", Epoch: 0, Version: "3.1.6", Release: "1.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv3+ and GPLv3+ and GFDL"}, Maintainer: "Fedora Project", Digest: "md5:a1339297aae3e31e8e1b1de00f793000", SrcName: "mpfr", SrcEpoch: 0, SrcVersion: "3.1.6", SrcRelease: "1.fc28"},
 				{Name: "gnutls", Epoch: 0, Version: "3.6.3", Release: "4.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"GPLv3+ and LGPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:6c813ffeecd51d2298766d86859395ca", SrcName: "gnutls", SrcEpoch: 0, SrcVersion: "3.6.3", SrcRelease: "4.fc28"},
 				{Name: "gzip", Epoch: 0, Version: "1.9", Release: "3.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"GPLv3+ and GFDL"}, Maintainer: "Fedora Project", Digest: "md5:efc5209278a36c1b62ee770a95e59929", SrcName: "gzip", SrcEpoch: 0, SrcVersion: "1.9", SrcRelease: "3.fc28"},
 				{Name: "acl", Epoch: 0, Version: "2.2.53", Release: "1.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"GPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:9f72a1f855b12dc038e3f4921c50db92", SrcName: "acl", SrcEpoch: 0, SrcVersion: "2.2.53", SrcRelease: "1.fc28"},
@@ -96,8 +96,8 @@ func TestParseRpmInfo(t *testing.T) {
 				{Name: "openldap", Epoch: 0, Version: "2.4.46", Release: "3.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"OpenLDAP"}, Maintainer: "Fedora Project", Digest: "md5:c98aaadc1c628656c7f90a18759da517", SrcName: "openldap", SrcEpoch: 0, SrcVersion: "2.4.46", SrcRelease: "3.fc28"},
 				{Name: "libseccomp", Epoch: 0, Version: "2.3.3", Release: "2.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv2"}, Maintainer: "Fedora Project", Digest: "md5:26c6a917063d5654083974de6734112d", SrcName: "libseccomp", SrcEpoch: 0, SrcVersion: "2.3.3", SrcRelease: "2.fc28"},
 				{Name: "npth", Epoch: 0, Version: "1.5", Release: "4.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:026afa87b50e9ec9812501188b6fd998", SrcName: "npth", SrcEpoch: 0, SrcVersion: "1.5", SrcRelease: "4.fc28"},
-				{Name: "gpgme", Epoch: 0, Version: "1.10.0", Release: "4.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:5a044754d91ca7d0b4e4428b052de6", SrcName: "gpgme", SrcEpoch: 0, SrcVersion: "1.10.0", SrcRelease: "4.fc28"},
-				{Name: "json-c", Epoch: 0, Version: "0.13.1", Release: "2.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"MIT"}, Maintainer: "Fedora Project", Digest: "md5:2d0c0ea344c78a2faeab869c9474f9", SrcName: "json-c", SrcEpoch: 0, SrcVersion: "0.13.1", SrcRelease: "2.fc28"},
+				{Name: "gpgme", Epoch: 0, Version: "1.10.0", Release: "4.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"LGPLv2+"}, Maintainer: "Fedora Project", Digest: "md5:5a044754d91ca7d0b4e4428b052de600", SrcName: "gpgme", SrcEpoch: 0, SrcVersion: "1.10.0", SrcRelease: "4.fc28"},
+				{Name: "json-c", Epoch: 0, Version: "0.13.1", Release: "2.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"MIT"}, Maintainer: "Fedora Project", Digest: "md5:2d0c0ea344c78a2faeab869c9474f900", SrcName: "json-c", SrcEpoch: 0, SrcVersion: "0.13.1", SrcRelease: "2.fc28"},
 				{Name: "libyaml", Epoch: 0, Version: "0.1.7", Release: "5.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"MIT"}, Maintainer: "Fedora Project", Digest: "md5:4e0f94eba782aa090fe6487142772aba", SrcName: "libyaml", SrcEpoch: 0, SrcVersion: "0.1.7", SrcRelease: "5.fc28"},
 				{Name: "libpkgconf", Epoch: 0, Version: "1.4.2", Release: "1.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"ISC"}, Maintainer: "Fedora Project", Digest: "md5:5721f7af98fca6a80db3d51fe0ad7312", SrcName: "pkgconf", SrcEpoch: 0, SrcVersion: "1.4.2", SrcRelease: "1.fc28"},
 				{Name: "pkgconf-pkg-config", Epoch: 0, Version: "1.4.2", Release: "1.fc28", Arch: "x86_64", Modularitylabel: "", Licenses: []string{"ISC"}, Maintainer: "Fedora Project", Digest: "md5:f297678d95f451aa7132d15aff3246a7", SrcName: "pkgconf", SrcEpoch: 0, SrcVersion: "1.4.2", SrcRelease: "1.fc28"},