Correct packages and relationships for ELF notes referencing dynamically loaded libraries
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What happened**:
A binary file with ELF notes describing a dynamically linked library results in a duplicate, incorrectly versioned package.
**What you expected to happen**:
Expect dynamically linked packages to not create incorrect packages. Ideally, these would result in appropriate relationships from package manager packages to the binary in where the library import is found.
**Steps to reproduce the issue**:
**Anything else we need to know?**:
Syft may be able to determine the package referenced in the ELF header is for a specific library import in the binary. The [imported libraries](https://github.com/anchore/syft/blob/main/syft/file/executable.go#L33) are already cataloged by the [executable cataloger](https://github.com/anchore/syft/tree/main/syft/file/cataloger/executable). We may be able to associate these with packages in the ELF notes, it may require some analysis of file locations and package manager ownership to connect the dots.
Contributor guide
Research direction
Start by reading syft/file/executable.go and the executable cataloger, especially how imported libraries are cataloged alongside ELF notes. Investigate how package-manager ownership and file locations could connect those records. Done means dynamically linked libraries no longer create duplicate or incorrectly versioned packages, and appropriate package-to-binary relationships are represented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100