Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vuln: fix integration tests in cmd/govulncheck/integration #59486

Closed
julieqiu opened this issue Apr 7, 2023 · 2 comments
Closed

x/vuln: fix integration tests in cmd/govulncheck/integration #59486

julieqiu opened this issue Apr 7, 2023 · 2 comments
Assignees
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Milestone

Comments

@julieqiu
Copy link
Member

julieqiu commented Apr 7, 2023

Fix integration tests in cmd/govulncheck/integration to handle the new JSON output.

Output of ./k8s k8s.txt

2023/04/10 21:18:53 reachable vulnerable packages mismatch (-want, +got):
  map[string]bool{
  	"crypto/tls":                                              true,
  	"github.com/containernetworking/cni/pkg/invoke":           true,
  	"github.com/evanphx/json-patch":                           true,
- 	"github.com/opencontainers/selinux/go-selinux":            true,
  	"github.com/prometheus/client_golang/prometheus/promhttp": true,
  	"golang.org/x/crypto/cryptobyte":                          true,
  	... // 4 identical entries
  	"golang.org/x/net/http2/hpack":       true,
  	"golang.org/x/text/encoding/unicode": true,
+ 	"html/template":                      true,
  	"mime/multipart":                     true,
  	"net/http":                           true,
+ 	"net/textproto":                      true,
  	"path/filepath":                      true,
  }

Output of ./stackrox-scanner scan.txt

2023/04/10 21:29:41 present vulnerable symbol packages mismatch (-want, +got):
  map[string]bool{
  	... // 2 identical entries
  	"crypto/elliptic":              true,
  	"crypto/tls":                   true,
+ 	"crypto/x509":                  true,
  	"encoding/pem":                 true,
  	"encoding/xml":                 true,
  	"golang.org/x/net/http2":       true,
  	"golang.org/x/net/http2/hpack": true,
+ 	"html/template":                true,
  	"mime/multipart":               true,
  	"net/http":                     true,
+ 	"net/textproto":                true,
  	"path/filepath":                true,
  	"regexp/syntax":                true,
  }
@julieqiu julieqiu added the vulncheck or vulndb Issues for the x/vuln or x/vulndb repo label Apr 7, 2023
@julieqiu julieqiu added this to the vuln/v0.1.0 milestone Apr 7, 2023
@mknyszek mknyszek added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Apr 8, 2023
@gopherbot
Copy link

Change https://go.dev/cl/482350 mentions this issue: cmd/govulncheck/integration: update tests

gopherbot pushed a commit to golang/vuln that referenced this issue Apr 11, 2023
Update integration tests to parse the new JSON output and use the
-mode=binary flag when scanning binaries.

For golang/go#59486

Change-Id: If59daa8cad1b886e6fc25441696acd930538afd0
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/482350
Auto-Submit: Julie Qiu <julie@golang.org>
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Julie Qiu <julie@golang.org>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
Reviewed-by: Julie Qiu <julie@golang.org>
@gopherbot
Copy link

Change https://go.dev/cl/483836 mentions this issue: cmd/govulncheck/integration: adjust test expectations

@zpavlinovic zpavlinovic self-assigned this Apr 12, 2023
@golang golang locked and limited conversation to collaborators Apr 11, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Projects
None yet
Development

No branches or pull requests

4 participants