Skip to content

Added md5sums and cleaned up the list files for dpkg packages#13

Merged
pacostas merged 2 commits intopaketo-buildpacks:mainfrom
miller79:add-md5sums-and-cleanup-list
May 16, 2025
Merged

Added md5sums and cleaned up the list files for dpkg packages#13
pacostas merged 2 commits intopaketo-buildpacks:mainfrom
miller79:add-md5sums-and-cleanup-list

Conversation

@miller79
Copy link
Copy Markdown
Contributor

@miller79 miller79 commented May 15, 2025

Summary

This is a continuation of scanner related issues with the tiny image. This change does the following

  • Cleans up the list file creation by doing 3 steps
    • Creates the list file using dpkg-deb -c $pkg*.deb | awk '{print substr($6, 2)}'
    • Replaces the first line with "/."
    • Removes the final "/" from all lines that end with a "/"
  • Creates the $pkg.md5sums file by using the command dpkg-deb -e $pkg*.deb MD5SUMS
  • Added test cases to address these changes.

This PR should address what is mentioned in the following issue (paketo-buildpacks/jammy-tiny-stack#153)

This is the PR for Jammy Tiny Stack related to this PR (paketo-buildpacks/jammy-tiny-stack#190)

Use Cases

These changes will hopefully address the issues from scanning tiny images with false positives with CVEs.

Checklist

  • I have viewed, signed, and submitted the Contributor License Agreement.
  • I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
  • I have added an integration test, if necessary.
  • I have reviewed the styleguide for guidance on my code quality.
  • I'm happy with the commit history on this PR (I have rebased/squashed as needed).

@miller79 miller79 changed the title Add md5sums and cleanup list Added md5sums and cleaned up the list files for dpkg packages May 15, 2025
@jericop
Copy link
Copy Markdown

jericop commented May 16, 2025

This looks good. I will wait until #10 has been merged before approving this PR.

@pacostas pacostas force-pushed the add-md5sums-and-cleanup-list branch from 884b1bb to f98a883 Compare May 16, 2025 15:19
Copy link
Copy Markdown
Member

@pacostas pacostas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jericop jericop requested a review from pacostas May 16, 2025 16:46
@jericop
Copy link
Copy Markdown

jericop commented May 16, 2025

Looks like acceptance tests are failing, so I removed the approval until that is resolved.

@miller79
Copy link
Copy Markdown
Contributor Author

Looks like acceptance tests are failing, so I removed the approval until that is resolved.

Is that from the changes from the other PR that was merged?

@pacostas
Copy link
Copy Markdown
Member

Looks like acceptance tests are failing, so I removed the approval until that is resolved.

Is that from the changes from the other PR that was merged?

Sorry, this is my bad, I'll fix it right away

miller79 added 2 commits May 16, 2025 22:07
Cleaned up list creation
Added MD5SUMS
Added new tests to ensure the md5sums exist.
@pacostas pacostas force-pushed the add-md5sums-and-cleanup-list branch from f98a883 to 76af3e7 Compare May 16, 2025 19:07
@pacostas
Copy link
Copy Markdown
Member

@miller79 It will pass now, sorry for the confusion :)

@miller79
Copy link
Copy Markdown
Contributor Author

@miller79 It will pass now, sorry for the confusion :)

Thanks for the assistance!

@pacostas pacostas merged commit ae6273e into paketo-buildpacks:main May 16, 2025
3 checks passed
@miller79 miller79 deleted the add-md5sums-and-cleanup-list branch May 17, 2025 00:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants