Don't include libexec directories in SCA includes

pkg/sca/sca.go

@@ -32,7 +32,7 @@ import (
 	"chainguard.dev/melange/pkg/config"
 )
 
-var libDirs = []string{"lib", "usr/lib", "lib64", "usr/lib64"}
+var libDirs = []string{"lib/", "usr/lib/", "lib64/", "usr/lib64/"}
 
 // SCAFS represents the minimum required filesystem accessors which are needed by
 // the SCA engine.
@@ -84,7 +84,7 @@ func allowedPrefix(path string, prefixes []string) bool {
 	return false
 }
 
-var cmdPrefixes = []string{"bin", "sbin", "usr/bin", "usr/sbin"}
+var cmdPrefixes = []string{"bin/", "sbin/", "usr/bin/", "usr/sbin/"}
 
 func generateCmdProviders(ctx context.Context, hdl SCAHandle, generated *config.Dependencies) error {
 	log := clog.FromContext(ctx)
@@ -371,7 +371,7 @@ var pkgConfigVersionRegexp = regexp.MustCompile("-(alpha|beta|rc|pre)")
 // TODO(kaniini): Turn this feature on once enough of Wolfi is built with provider data.
 var generateRuntimePkgConfigDeps = false
 
-var pcDirs = []string{"lib/pkgconfig", "usr/lib/pkgconfig", "lib64/pkgconfig", "usr/lib64/pkgconfig"}
+var pcDirs = []string{"lib/pkgconfig/", "usr/lib/pkgconfig/", "lib64/pkgconfig/", "usr/lib64/pkgconfig/"}
 
 // generatePkgConfigDeps generates a list of provided pkg-config package names and versions,
 // as well as dependency relationships.

pkg/sca/sca_test.go

@@ -148,6 +148,9 @@ func TestExecableSharedObjects(t *testing.T) {
 
 func TestVendoredPkgConfig(t *testing.T) {
 	ctx := context.Background()
+	// Generated by:
+	// curl -L https://packages.wolfi.dev/os/aarch64/neon-4604-r0.apk > neon.apk
+	// tardegrade <neon.apk echo $(tar -tf neon.apk| head -n 2) $(tar -tf neon.apk | grep pkgconfig) usr/libexec/neon/v14/lib/libecpg_compat.so.3.14 > neon-4604-r0.apk
 	th := handleFromApk(context.Background(), t, "neon-4604-r0.apk", "neon.yaml")
 	defer th.exp.Close()
 
@@ -157,7 +160,13 @@ func TestVendoredPkgConfig(t *testing.T) {
 	}
 
 	want := config.Dependencies{
+		Runtime: []string{
+			// We only include libecpg_compat.so.3 to test that "libexec" isn't treated as a library directory.
+			// These are dependencies of libecpg_compat.so.3, but if we had the whole neon APK it would look different.
+			"so:libecpg.so.6", "so:libpgtypes.so.3", "so:libpq.so.5", "so:libc.so.6", "so:ld-linux-aarch64.so.1",
+		},
 		Vendored: []string{
+			"so:libecpg_compat.so.3=3",
 			"pc:libecpg=14.10",
 			"pc:libecpg_compat=14.10",
 			"pc:libpgtypes=14.10",