anchore / anchore/syft

Support mongo binary various versions

Open
#4,609 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:

Current matcher can not detect some pattern
- rc version
- 8.x (8.0.17-noble is detected)
- 7.x (7.0.28-jammy, 7.0.23-jammy, 7.0.22-jammy, 7.0.15, 7.0.0-jammy are detected)
- 3.x.x (3.7.x, 3.5.7, 3.5.8, 3.5.9 are detected)

**Steps to reproduce the issue**:

```
$ syft -q mongo:8.2.4 --override-default-catalogers binary-classifier-cataloger
NAME VERSION TYPE
bash 5.2.21 binary
gzip 1.12 binary
jq 1.7 binary
openssl 3.0.13 binary
util-linux 2.39.3 binary

$ docker run -it --rm mongo:8.2.4 mongod --version
db version v8.2.4
Build Info: {
"version": "8.2.4",
"gitVersion": "60692d74054a0bc73f181179e747815825de38ae",
"openSSLVersion": "OpenSSL 3.0.13 30 Jan 2024",
"modules": [],
"allocator": "tcmalloc-google",
"environment": {
"distmod": "ubuntu2404",
"distarch": "x86_64",
"target_arch": "x86_64"
}
}
```

**Anything else we need to know?**:

If mongodb is installed manually, syft will not detect these mongo

Contributor guide

Open the contributing guide

Research direction

Start with Syft's binary-classifier-cataloger and reproduce the reported result against mongo:8.2.4 using the shown syft command, then compare it with mongod --version. Done means MongoDB binaries are detected for the listed rc, 8.x, 7.x, and 3.x.x version patterns, including manually installed MongoDB.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, mongodb
Domain
cli, devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.