chore: migrate syft to use mholt/archives instead of anchore fork#4029

Merged

spiffcs merged 16 commits intoanchore:mainfrom

Rupikz:upgrade-deprecated-archiver

Nov 13, 2025

Contributor

Rupikz commented Jun 26, 2025

Description

Rewritten deprecated fork github.com/anchore/archiver to github.com/mholt/archives

Type of change

Bug fix (non-breaking change which fixes an issue)
Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)

Checklist:

I have tested my code in common scenarios and confirmed there are no regressions

spiffcs added the needs-discussion label

spiffcs removed the needs-discussion label

spiffcs reviewed

View reviewed changes

syft/source/filesource/file_source.go

-              	cleanupFn := func() error {
-              		return os.RemoveAll(tempDir)
+              	visitor := func(_ context.Context, file archives.FileInfo) error {
+              		destPath, err := intFile.SafeJoin(tempDir, file.NameInArchive)

Contributor

spiffcs Oct 13, 2025

I updated this to use the same kind of SafeJoin functionality so we don't escape the tmpDir like we do in other parts of syft. If the archives library already handles this internally apologies I just couldn't find it on a quick inspection.

Contributor

spiffcs commented Oct 13, 2025 •

edited

Loading

@wagoodman I've looked at this one and added a small protection.

The visitor now uses a path aware directory join and cannot write outside the temp directory.
Tests also added.
Can you give a second pair of 👀 on this since I added a commit and would like a second review before we 🟢.

Also, I don't know what Static Analysis is on about here. I've checked out this branch even on a different machine and it's told me the go.mod and go.sum are tidy locally ☹️. I ended up doing a manual edit to fix the go.sum, but that seems super wrong.

spiffcs requested a review from wagoodman

October 13, 2025 16:38

spiffcs previously approved these changes

View reviewed changes

Contributor

spiffcs left a comment

This one now looks good to me after a first pass review. I identified a section in the visitor where we might be able to escape and write files to paths outside the temp directory so added a fix for this. I'd like additional 👀 from someone on @anchore/tools to check my work.

spiffcs self-requested a review

October 13, 2025 19:52

spiffcs dismissed their stale review

October 13, 2025 19:53

one more change is needed here where we also protect against symlink attacks

This was referenced Nov 6, 2025

feat: use better archives library #4339

Closed

Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 #4338

Closed

Rupikz and others added 7 commits

November 10, 2025 12:57


          upgrade deprecated library for archiving

dc80289

Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com>


          fix linting

3d1c760

Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com>


          fix go mod tidy release problem

fba6ccb

Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com>


          fix: protect against traversal in file source

eda6988

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>


          fix: lint-fix

869dce4

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>


          docs: docs to trigger ci

1470ccd

Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com>


          chore: fix tidy again

cfad5bb

Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com>

spiffcs force-pushed the upgrade-deprecated-archiver branch from 923d9a8 to cfad5bb Compare

November 10, 2025 17:59

spiffcs added 3 commits

November 10, 2025 13:30


          test: add zip symlink traversal tests

286bcfe

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>


          Merge branch 'main' into upgrade-deprecated-archiver

3da4d12

Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>


          chore: gomod

54d3103

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

wagoodman reviewed

View reviewed changes

syft/source/filesource/file_source.go Outdated


          fix: single safe-join

17bbb8c

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

kzantow reviewed

View reviewed changes

Contributor

kzantow left a comment

Overall LGTM the SafeJoin usage I think is good 👍 main things I think we should update:

don't ever need to log.Error close problems, there's a CloseAndLogError utility to simplify a bunch of those calls anyway
the tests don't seem to be actually testing the function we want to verify: UnzipToDir

internal/file/tar_file_traversal.go Outdated

internal/file/zip_file_traversal_test.go Outdated

internal/file/zip_file_traversal_test.go Outdated

internal/file/zip_file_traversal.go


          add additional tests showing no zip traversal issues

e5d137a

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

spiffcs mentioned this pull request

chore: migrate grype to use mholt/archives instead of anchore fork anchore/grype#3036

Merged

wagoodman reviewed

View reviewed changes

internal/file/zip_file_traversal_test.go Outdated

spiffcs added 2 commits

November 13, 2025 15:34


          pr: test-fixes

ac75dbd

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>


          pr: update to use internal CloseAndLogError

9c2c27a

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

wagoodman approved these changes

View reviewed changes

spiffcs added 2 commits

November 13, 2025 17:47


          Merge branch 'main' into upgrade-deprecated-archiver

33110a4

Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>


          chore: go mod tidy

aa80c36

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>

spiffcs changed the title ~~Migrate syft to use archives instead of anchore fork~~ chore: migrate syft to use mholt/archives instead of anchore fork

spiffcs enabled auto-merge (squash)

November 13, 2025 22:50

spiffcs merged commit 89842bd into anchore:main

12 checks passed

BrewTestBot mentioned this pull request

syft 1.38.0 Homebrew/homebrew-core#254775

Merged

VictorHuu mentioned this pull request

v1.38.0 generates empty sbom for tgz sources #4416

Closed

l-qing pushed a commit to AlaudaDevops/syft that referenced this pull request


          chore: migrate syft to use mholt/archives instead of anchore fork (an…

…chore#4029)

l-qing mentioned this pull request

chore: migrate syft to use mholt/archives instead of anchore fork AlaudaDevops/syft#22

Merged

9 tasks

l-qing pushed a commit to AlaudaDevops/syft that referenced this pull request


          chore: migrate syft to use mholt/archives instead of anchore fork (an…

048070c

…chore#4029)

l-qing pushed a commit to AlaudaDevops/syft that referenced this pull request


          chore: migrate syft to use mholt/archives instead of anchore fork (an…

c849112

…chore#4029)

---------
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com>
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

l-qing added a commit to AlaudaDevops/syft that referenced this pull request


          chore: migrate syft to use mholt/archives instead of anchore fork (#22)

efec31b

* chore: migrate syft to use mholt/archives instead of anchore fork (anchore#4029)

---------
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com>
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix(java): initialize license scanner in archive parser

This commit addresses a potential vulnerability where the license
scanner was not properly initialized before use in the Java archive
parser, which could lead to nil pointer dereference.

Additionally, updates test fixtures and assertions to reflect:
- Updated package versions in Rocky Linux (curl-minimal, httpd)
- Refactored deduplication tests to index by package name for
  better resilience to version changes
- Added comprehensive test documentation

---------

Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com>
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Kudryavcev Nikolay <35200428+Rupikz@users.noreply.github.com>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet