test: add E2E test for Mageia ecosystem mapping - #2873
Open
herdiyana256 wants to merge 8 commits into
Open
Conversation
Contributor
Author
|
Hi @michaelkedar, this is the E2E test PR for Mageia as requested in osv-scalibr#2177. The osv-scalibr mapping is in #2199 and the E2E tests are here. Could you approve the workflows so CI can run? Happy to address any feedback. Thanks! |
herdiyana256
changed the title
herdiyana256
changed the title
herdiyana256
force-pushed
the
feature/os-mageia-ecosystem-e2e-v2
branch
from
June 26, 2026 07:32
ac4c721 to
8e627d3
Compare
Contributor
Author
|
Hi @michaelkedar, just pushed a few additional fixes to address the CI failures: Thanks! |
Contributor
Author
|
Hi @michaelkedar, following up on #2873 (Mageia E2E test). Could you approve the workflows so CI can run? Depends on #2199 landing first. Thanks! :) |
Collaborator
|
Seems like you need to update the snapshots for the magia base image, as we are correctly detecting it now. |
Add end-to-end test for scanning Mageia 9 container images to verify that the Mageia ecosystem mapping (added in google/osv-scalibr#2199) is correctly exercised by osv-scanner. Changes: - Add test-mageia-9.Dockerfile fixture based on mageia:9 (pinned to sha256:9f7cd063...) which contains bundled Python wheels with known PyPI vulnerabilities - Add TestCommand_OCIImage/Scanning_Mageia_9_image test case in command_test.go to scan the generated Mageia tarball - Add TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image test case for JSON output format validation - Update snapshots and cassettes with successful scan results This follows the same pattern as the AlmaLinux E2E test (google#2870) as requested by @michaelkedar in google/osv-scalibr#2177. Tested via: make test ACC=true SNAPS=true SHORT=false TestCommand_OCIImage/Scanning_Mageia_9_image passes successfully.
…e image - Bump github.com/google/osv-scalibr to v0.4.6-0.20260713000915-500ad84f4ed1 which includes the Mageia ecosystem mapping fix (google/osv-scalibr#2199) - Update TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image snapshot to reflect that the Mageia base image is now correctly detected (base_image_index updated, 'mageia' added to base_images list) - Update TestCommand_OCIImage_JSONFormat cassette with new API interaction order Fixes snapshot mismatch that caused CI failures on all platforms.
herdiyana256
force-pushed
the
feature/os-mageia-ecosystem-e2e-v2
branch
from
July 13, 2026 12:45
d5fa2fd to
af567eb
Compare
Contributor
Author
|
Hi @another-rex, thanks for the feedback! I've updated the PR to address the snapshot mismatch:
The Mageia base image is now properly identified in the scan output. All Mageia-related tests pass locally. CI should now be green. |
Contributor
Author
|
Hi @another-rex, follow-up on this one snapshot/cassette updates from the last push address your feedback, all Mageia tests pass locally now. Still needs a review approval plus workflow approval to unblock CI/CodeQL. Could you take a look? Thanks! |
4 tasks
herdiyana256
added a commit
to herdiyana256/osv-scanner
that referenced
this pull request
Aug 5, 2026
osv-scalibr's os/rpm extractor has a Windows-only stub (rpm_dummy.go, //go:build windows) whose FileRequired() always returns false, so no RPM packages are ever detected there. This is upstream/pre-existing and affects any RPM-based image test on windows-latest, not something introduced by this PR (the same failure mode hits the AlmaLinux google#2870 and Mageia google#2873 E2E PRs for the same reason).
another-rex
added a commit
that referenced
this pull request
Aug 7, 2026
## Summary Adds an end-to-end test for the openSUSE Leap ecosystem mapping fix that just merged in [google/osv-scalibr#2290](google/osv-scalibr#2290) (closes [google/osv-scalibr#2203](google/osv-scalibr#2203)), following the same pattern used for the AlmaLinux (#2870) and Mageia (#2873) ecosystem E2E tests. - Adds a pinned `opensuse/leap:15.5` image fixture (`test-opensuse-leap-15.5.Dockerfile`). - Adds `Scanning_openSUSE_Leap_15.5_image` / `scanning_opensuse_leap_15.5_image` cases to `TestCommand_OCIImage` and `TestCommand_OCIImage_JSONFormat`, with recorded cassette entries and snapshots showing real SUSE-SU advisories detected for `curl` and `openssl-1_1`. While wiring this up I found the `os/rpm` extractor was never registered in the `artifact` preset used by image scanning (`internal/scalibrplugin/presets.go`), so any RPM-based image, not just openSUSE Leap, currently scans with zero package inventory ("No package sources found"). This is the same root cause already fixed for AlmaLinux in #2870 (commit f995ea5), which hasn't landed on `main` yet, so I included the same registration here to unblock this test. Updated the snapshots/cassettes it touches (`scan/source`, `internal/output`, `internal/scalibrplugin`). `go.mod` points at a branch on my osv-scalibr fork carrying just the openSUSE Leap ecosystem fix cherry-picked onto the same osv-scalibr base already used by the AlmaLinux/Mageia branches. Bumping straight to the latest osv-scalibr `main` pulls in unrelated breaking API changes (`PluginConfig` refactor, Maven client signature changes, etc.) that osv-scanner hasn't absorbed yet. This is the same temporary-replace pattern used while #2250 was in flight; happy to drop it once either this or the AlmaLinux/Mageia scalibr bump lands. ## Test plan - [x] `go build ./...`: clean - [x] `go test ./... -short`: all packages pass - [x] `TEST_ACCEPTANCE=true go test ./cmd/osv-scanner/scan/image/... -run 'TestCommand_OCIImage$|TestCommand_OCIImage_JSONFormat$'`: all pass, including the new openSUSE Leap cases - [x] Verified the JSON snapshot shows real detections: `curl 8.0.1-150400.5.50.1` matches `SUSE-SU-2024:3926-1` and `SUSE-SU-2024:4359-1`; `openssl-1_1 1.1.1l-150500.17.34.1` matches `SUSE-SU-2024:3765-1`; ecosystem `openSUSE:Leap 15.5`; base image `opensuse/leap` correctly detected. cc @Ly-Joey: this follows up on your review request on google/osv-scalibr#2290 to add E2E coverage for the openSUSE Leap ecosystem mapping. --------- Co-authored-by: Rex P <rexpan@google.com> Co-authored-by: Rex P <106129829+another-rex@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add end-to-end test for scanning Mageia 9 container images to verify that the Mageia ecosystem mapping (added in google/osv-scalibr#2199) is correctly exercised by osv-scanner.
Changes:
This follows the same pattern as the AlmaLinux E2E test (#2870) as requested by @michaelkedar in google/osv-scalibr#2177.
Tested via: make test ACC=true SNAPS=true SHORT=false TestCommand_OCIImage/Scanning_Mageia_9_image passes successfully.