anchore / anchore/grant

Follow/resolve directory symlinks during license file search

Open
#401 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
183
Forks
18
Avg merge
3d 7h
Merged PRs (30d)
7

Description

## Summary

When scanning a directory for license files(not syft sbom generation), `grant` skips symlinks that point to directories. This means license files inside symlinked directories are not discovered by the local license file search:

https://github.com/anchore/grant/blob/8358948e7569c6d31b2fb14bf431ebe88ab3a231/grant/case.go#L400-L440

This was discovered as a bug in #70. `filepath.WalkDir` uses `lstat` semantics and never descends into symlinked directories. They appear as non-directory entries. Without skipping them, they get passed to the license classifier, which causes errors.

## Current behavior

- Symlinks to regular files: **followed** (license is detected)
- Symlinks to directories: **skipped** (licenses inside are missed)
- Broken symlinks: **skipped**

## Desired behavior

Directory symlinks should be resolved and followed during the license file search, with cycle detection to prevent infinite loops (e.g., `a -> b -> a`).

Contributor guide

Open the contributing guide

Research direction

Start in grant/case.go around lines 400-440 and inspect the local license file search built on filepath.WalkDir, including its handling of symlink entries. Done means directory symlinks are resolved and searched, broken symlinks remain skipped, and cycles such as a -> b -> a cannot cause infinite traversal.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.