anchore / anchore/syft

Correct packages and relationships for ELF notes referencing dynamically loaded libraries

Open
#4,604 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:
A binary file with ELF notes describing a dynamically linked library results in a duplicate, incorrectly versioned package.

**What you expected to happen**:
Expect dynamically linked packages to not create incorrect packages. Ideally, these would result in appropriate relationships from package manager packages to the binary in where the library import is found.

**Steps to reproduce the issue**:

**Anything else we need to know?**:
Syft may be able to determine the package referenced in the ELF header is for a specific library import in the binary. The [imported libraries](https://github.com/anchore/syft/blob/main/syft/file/executable.go#L33) are already cataloged by the [executable cataloger](https://github.com/anchore/syft/tree/main/syft/file/cataloger/executable). We may be able to associate these with packages in the ELF notes, it may require some analysis of file locations and package manager ownership to connect the dots.

Contributor guide

Open the contributing guide

Research direction

Start by reading syft/file/executable.go and the executable cataloger, especially how imported libraries are cataloged alongside ELF notes. Investigate how package-manager ownership and file locations could connect those records. Done means dynamically linked libraries no longer create duplicate or incorrectly versioned packages, and appropriate package-to-binary relationships are represented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
devtools
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.