Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: deterministic java purls #2170

Merged
merged 2 commits into from
Sep 25, 2023
Merged

Conversation

willmurphyscode
Copy link
Contributor

Previously, iterating over the map to build up a string slice of groupID candidates resulted in non-deterministic selection of the groupID. Fix that by sorting candidates, and update some integration tests that were only passing because of the issue.

There might be more discussion needed here:

  1. The comment at
    groupIDS := cpe.GetManifestFieldGroupIDs(manifest, cpe.PrimaryJavaManifestGroupIDFields)
    // assumes that primaryJavaManifestNameFields are ordered by priority
    if len(groupIDS) != 0 {
    seems like it was never true, since the array order coming back from GetManifestFieldGroupIDs was non-deterministic due to iterating maps
  2. There's no reason to suppose that the lexicographically first group ID is a better choice than whatever group ID happened to win the map iteration.

Fixes #2169, but open to discussion about whether this is the right approach.

Otherwise, which PURL is generated depends on the order of key iteration
in maps.

Signed-off-by: Will Murphy <[email protected]>
Apparently this test was only passing because of the map iteration
fixed in the previous commit.

Signed-off-by: Will Murphy <[email protected]>
@willmurphyscode willmurphyscode merged commit e34adea into main Sep 25, 2023
9 checks passed
@willmurphyscode willmurphyscode deleted the fix/deterministic-java-purls branch September 25, 2023 13:28
GijsCalis pushed a commit to GijsCalis/syft that referenced this pull request Feb 19, 2024
Previously, which PURL was generated depended on the order of key iteration
in maps. Also update an integ test that was apparently only passing because
of the previous issue.

Signed-off-by: Will Murphy <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Generated purls are different between runs of syft against the same image and artifact
2 participants