Skip to content

The --experimental-offline and --experimental-download-offline-databases are broken for Debian packages #1115

@bernard-dataexpert

Description

@bernard-dataexpert

To reproduce run the following:

 docker run --rm -v "$PWD:$PWD" -w "$PWD" debian cat /var/lib/dpkg/status > dpkg.status
 # works
 docker run --rm -v "$PWD:$PWD" -w "$PWD" ghcr.io/google/osv-scanner:v1.8.2 --lockfile 'dpkg-status:dpkg.status'
 # breaks
 docker run --rm -v "$PWD:$PWD" -w "$PWD" ghcr.io/google/osv-scanner:v1.8.2 --lockfile 'dpkg-status:dpkg.status' --experimental-offline --experimental-download-offline-databases

It works in online mode, but in offline mode it generates the following error:

Scanned /home/ben/dpkg.status file as a dpkg-status and found 88 packages
Loaded Debian:12 local db from /root/.cache/osv-scanner/Debian:12/all.zip
panic: unsupported ecosystem Debian:12

goroutine 1 [running]:
github.com/google/osv-scanner/internal/semantic.MustParse(...)
        github.com/google/osv-scanner/internal/semantic/parse.go:16
github.com/google/osv-scanner/internal/utility/vulns.rangeContainsVersion({{0xc002359930, 0x9}, {0xc00236db80, 0x2, 0x2}, {0x0, 0x0}, 0x0}, {{0xc00044e118, 0x3}, ...})
        github.com/google/osv-scanner/internal/utility/vulns/vulnerability.go:44 +0x351
github.com/google/osv-scanner/internal/utility/vulns.rangeAffectsVersion({0xc002379880?, 0x1, 0x20e5400?}, {{0xc00044e118, 0x3}, {0xc00044e159, 0x7}, {0x0, 0x0}, {0xc00044f6d0, ...}, ...})
        github.com/google/osv-scanner/internal/utility/vulns/vulnerability.go:84 +0x14f
github.com/google/osv-scanner/internal/utility/vulns.IsAffected({{0xc0023599a0, 0x5}, {0xc0023598a0, 0xd}, {0x0, 0xede134012, 0x0}, {0x0, 0xec2c58e08, 0x0}, ...}, ...)
        github.com/google/osv-scanner/internal/utility/vulns/vulnerability.go:153 +0x2a5
github.com/google/osv-scanner/internal/local.(*ZipDB).VulnerabilitiesAffectingPackage(0xc000566748?, {{0xc00044e118, 0x3}, {0xc00044e159, 0x7}, {0x0, 0x0}, {0xc00044f6d0, 0x9}, {0xc00044f6d0, ...}, ...})
        github.com/google/osv-scanner/internal/local/zip.go:239 +0x2d8
github.com/google/osv-scanner/internal/local.MakeRequest({0x17ea9e8, 0xc0002e3f00}, {{0xc00058d000?, 0x4?, 0xc00044fdb0?}}, 0x0, {0x0, 0x0})
        github.com/google/osv-scanner/internal/local/check.go:153 +0x658
github.com/google/osv-scanner/pkg/osvscanner.makeRequest({0x17ea9e8, 0xc0002e3f00}, {0xc0003bf000?, 0x58, 0x130d940?}, 0x1, 0x1, {0x0, 0x0})
        github.com/google/osv-scanner/pkg/osvscanner/osvscanner.go:1025 +0x80a
github.com/google/osv-scanner/pkg/osvscanner.DoScan({{0xc0005b2980, 0x1, 0x1}, {0x0, 0x0, 0x0}, {0x20e3980, 0x0, 0x0}, {0x0, ...}, ...}, ...)
        github.com/google/osv-scanner/pkg/osvscanner/osvscanner.go:896 +0x135c
github.com/google/osv-scanner/cmd/osv-scanner/scan.action(0xc0002e3600, {0x17db5c0, 0xc00007e028}, {0x17db5c0, 0xc00007e030})
        github.com/google/osv-scanner/cmd/osv-scanner/scan/main.go:202 +0xc6e
github.com/google/osv-scanner/cmd/osv-scanner/scan.Command.func2(0xc0001ecb00?)
        github.com/google/osv-scanner/cmd/osv-scanner/scan/main.go:139 +0x2c
github.com/urfave/cli/v2.(*Command).Run(0xc0001ecb00, 0xc0002e3600, {0xc00042f1d0, 0x5, 0x5})
        github.com/urfave/cli/v2@v2.27.2/command.go:276 +0x9dd
github.com/urfave/cli/v2.(*Command).Run(0xc0001ed1e0, 0xc0002e34c0, {0xc0004e8780, 0x6, 0x6})
        github.com/urfave/cli/v2@v2.27.2/command.go:269 +0xc2e
github.com/urfave/cli/v2.(*App).RunContext(0xc00040cc00, {0x17e7568?, 0x20e3980}, {0xc0004e8780, 0x6, 0x6})
        github.com/urfave/cli/v2@v2.27.2/app.go:333 +0x5db
github.com/urfave/cli/v2.(*App).Run(...)
        github.com/urfave/cli/v2@v2.27.2/app.go:307
main.run({0xc00003e0a0, 0x5, 0x5}, {0x17db5c0?, 0xc00007e028}, {0x17db5c0?, 0xc00007e030})
        github.com/google/osv-scanner/cmd/osv-scanner/main.go:52 +0x712
main.main()
        github.com/google/osv-scanner/cmd/osv-scanner/main.go:126 +0x45

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions