Repository navigation
SUB-9486: move to syft v1.55.0 and drop the stereoscope v0.1.9 pin - #1061
Conversation
jnathangreeg
added
ai-assisted
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 10 minutes. View limit details
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update direct requirements go.mod |
Direct requirements are upgraded, including Syft and SQLite. |
Refresh indirect requirements go.mod |
Indirect dependency versions and membership change across multiple package groups. |
Update module replacements go.mod |
The Syft replacement targets the Kubescape fork. Containerd replacements are pinned, and the stereoscope replacement is removed. Comments document the stated compatibility constraints. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Possibly related issues
- Upgrade Inspektor Gadget to v0.57.0 via kubescape fork and preserve exec/path semantics #1050: The issue discusses the related Inspektor Gadget and stereoscope dependency graph and retained containerd pins; it identifies the Inspektor Gadget replacement as follow-up work.
Possibly related PRs
- kubescape/node-agent#1062: This PR changes the Inspektor Gadget replacement and image versions in
go.mod; the supplied context says the two dependency changes affect the resolved module graph. - kubescape/node-agent#1054: This PR changes the containerd v1 and Inspektor Gadget requirements that interact with the containerd pins in this change.
Suggested reviewers: matthyx
Merge Risk: 
fc74c
-
No concrete blocker is established for this dependency refresh. Mergeability remains subject to normal checks; the reported build succeeded, but tests were not executed.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies the main changes: moving to Syft v1.55.0 and removing the stereoscope v0.1.9 pin. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
matthyx
left a comment
matthyx
left a comment
There was a problem hiding this comment.
The Inspektor Gadget replacement in go.mod:511 points to a9e2040fee2f, which is not on the fork’s main branch. The check-ig-pin job fails on this exact head, and the prerequisite kubescape/inspektor-gadget#19 is still open. Please merge the prerequisite and repin to the resulting commit on main before merging this PR, then rerun the affected checks. The draft status also prevents approval at present.
matthyx
left a comment
matthyx
left a comment
There was a problem hiding this comment.
Please bump the syft fork to v1.55.0-ks.3:
replace github.com/anchore/syft => github.com/kubescape/syft v1.55.0-ks.3
ks.2 is missing 03393509 ("fix: bound the pre-filter ELF parses with elfutil"). Without that commit, the binutils pre-filters still parse ELF files with debug/elf directly, before the bounded elfutil.NewFile. That leaves the golang, rust and elf-package catalogers open to the crafted-binary OOM. ks.3 is the branch tip feature/selective+prefilter-v1.55.0, which has that fix.
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
7452dc8 to
afd0cc2
Compare
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
|
Please update the PR description. It still says the fork replace moves to Also, this PR can't merge before kubescape/inspektor-gadget#19. The IG replace pins a commit from that unmerged branch, so |
|
Please hold this PR until #1062 (inspektor-gadget v0.57.0 via the kubescape fork) lands, and revert the re-pin to 79b3b49b in c6b76fa. Re-pinning to the fork's |
|
Agreed on all three points — reverted in 9c77da7. You're right that the re-pin was out of scope. The pin is back to This PR holds for #1062, then rebases onto it and drops the inspektor-gadget replace entirely. On whether the containerd pins are still needed on top of IG v0.57.0 — yes, they are. v0.57.0 does not move off containerd v1: So the diamond is unchanged, and if anything tighter than I'd assumed — v0.57.0 wants Worth noting for #1062: that PR will hit the same wall the moment stereoscope v0.3.4 enters its graph, so the containerd/v2 and containerd/api pins probably need to travel with whichever of the two lands second. Happy to re-verify on linux once #1062 is closer. |
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
|
@jnathangreeg #1062 has merged |
Rebased onto main now that #1062 has merged, and this PR's inspektor-gadget replace is dropped entirely as requested — the IG pin is #1062's, untouched here. What remains is the syft move: require v1.55.0, the fork replace to kubescape/syft v1.55.0-ks.3, and dropping the stereoscope => v0.1.9 pin, which syft v1.55.0 cannot use (it needs 0.3.x). The containerd pins are kept, and re-verified rather than assumed. Building on top of #1062 without them fails exactly as before: containerd@v1.7.36/sandbox/bridge.go:36 grpcBridge missing UpdateSandbox containerd/v2@v2.4.1/pkg/oci/spec_opts.go cannot use &limit (*int64) as int64 IG v0.57.0 still requires and imports containerd v1.7.36 (runtime-spec v1.2.1, api v1.8.0), so the diamond survives the upgrade and containerd/v2 stays at v2.2.0 with containerd/api at v1.10.0. Verified with CGO_ENABLED=0 GOOS=linux GOARCH=amd64: builds clean. Signed-off-by: jnathangreeg <jonathang@armosec.io> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
9c77da7 to
fc74ccc
Compare
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
|
@jnathangreeg thanks for the rebase. The replace set looks right now. Two things before I approve:
|
v0.0.382 is the first storage release containing kubescape/storage#471, which adds the 28 syft package metadata types new since v1.42.3 and the "snap" and "oci-model" source types. The source types are the load-bearing half. storage's unpackSrcMetadata has no sentinel, unlike unpackPkgMetadata: an unrecognised non-empty source type is a hard decode failure that loses the whole document, not a lossy fallback. So an SBOM whose source is a snap or an OCI model does not round-trip through a storage older than this. Readers before writers -- node-agent must not ship on syft v1.55 against a storage that cannot decode what it may now emit. Verified with CGO_ENABLED=0 GOOS=linux GOARCH=amd64: builds clean. Signed-off-by: jnathangreeg <jonathang@armosec.io> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Both done. 1. Description rewritten. It described the pre-rebase state throughout, not just the pin. "What moved" now lists the IG replace as untouched — it is main's Blocker 2 I rewrote rather than just re-labelled, because it is the part v0.57.0 does not solve and I had only asserted that before. Building this branch on top of #1062 without the containerd pins reproduces both errors verbatim: v0.57.0 still requires and imports containerd v1.7.36 ( 2. Storage bumped to v0.0.382 in You are right that this belongs here, and the source types are the sharp end:
|
matthyx
left a comment
matthyx
left a comment
There was a problem hiding this comment.
Thanks, both points are addressed. Storage is now on v0.0.382, and the description matches the rebased state. The replace set is right: IG stays on main's 9864428b, syft is on v1.55.0-ks.3, and the containerd/v2 v2.2.0, containerd/api v1.10.0 and runtime-spec v1.2.1 pins hold the containerd diamond together. I reproduced that build failure and the fix locally on main. The syft-related tests in sbommanager and sbomscanner pass.
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
Jira: SUB-9486
go.mod / go.sum only — no source changes were needed.
Rebased onto main after #1062 (IG v0.57.0 via the kubescape fork) merged, so this is now a single commit of syft work on top of it.
What moved
github.com/anchore/syftv1.42.3 → v1.55.0, fork replacekubescape/syft v1.32.0-ks.2→ v1.55.0-ks.3replace github.com/anchore/stereoscope => v0.1.9— removed (syft v1.55.0 brings stereoscope v0.3.4)github.com/kubescape/storagev0.0.303 → v0.0.382The inspektor-gadget replace is untouched. It is main's pin from #1062 (
9864428b, IG v0.57.0). An earlier revision of this PR moved it; that was reverted, because re-pinning to the fork's main pulled in ~45 IG commits node-agent had never shipped. Moving the IG pin was #1062's job and it has done it.Blocker 1 — ambiguous
github.com/moby/moby/client— RESOLVED by #1062stereoscope v0.3.x imports
github.com/moby/moby/client, which is now its own module but still also lives inside thegithub.life-white.uk/moby/mobymonolith that inspektor-gadget required. Go reportsambiguous importand no pin can resolve it — the fix had to be in IG.#1062 moved node-agent to IG v0.57.0, which is off the monolith, so this is handled upstream of this PR. (kubescape/inspektor-gadget#19 fixed the same collision on the older fork line; it is no longer the route taken here.)
Blocker 2 — containerd v1 / containerd/v2 diamond — still real on top of v0.57.0
This is the part IG v0.57.0 does not solve, and I re-verified it rather than assuming. Building this branch on top of #1062 without the containerd pins fails exactly as before:
Upstream IG v0.57.0 still requires and imports containerd v1.7.36 (
runtime-spec v1.2.1,api v1.8.0), so both containerd majors remain in the graph and must agree on onecontainerd/apiand oneruntime-spec:syft only declares v2.4.1; it compiles against v2.2.0. Hence:
Measure this on linux. On darwin the IG and node-agent subtrees are excluded by build constraints, so containerd v1 is never compiled and any
go list -depscount is misleadingly zero.Why the storage bump belongs here
v0.0.382 is the first storage release containing kubescape/storage#471, which adds the 28 syft package metadata types new since v1.42.3 plus the
snapandoci-modelsource types.The source types are the load-bearing half. storage's
unpackSrcMetadatahas no sentinel, unlikeunpackPkgMetadata: an unrecognised non-empty source type is a hard decode failure that loses the whole document, not a lossy fallback. So an SBOM whose source is a snap or an OCI model does not round-trip through an older storage. Readers before writers — node-agent should not ship on syft v1.55 against a storage that cannot decode what it may now emit.Why ks.3 rather than ks.2
ks.3 adds
03393509, which routes the fork's binutils section pre-filters through the boundedelfutil.NewFile. Without it the golang, rust and elf-package catalogers parse attacker-supplied ELF withdebug/elfdirectly, ahead of the bounded call — the crafted-compression-header OOMelfutilexists to stop. It also fixes the pre-filters silently skipping non-ELF (Mach-O/PE) binaries.Verified
Call sites re-checked against syft v1.55.0:
directorysource.Config,directorysource.NewandGetDirectoryExclusionFunctionsare unchanged — the only upstream delta is a trailing-slash trim bugfix. The in-place rewrite of the exclusion slice still happens, so theslices.Cloneguard insyftutil/directory_source.gois still required.file-digest-cataloger,file-metadata-catalogerandfile-executable-catalogerall still exist (internal/task/file_tasks.go), so theWithRemovalscalls inhost_sbom.go,sbom_manager.goandsbomscanner/v1/server.goare not silent no-ops.fileresolver.NewFromDirectorykeeps the upstream signature in the fork (the selective-index matcher lives on an unexported constructor), so no call site gains a parameter.Tests were not executed — node-agent is linux-only and the build host is darwin. The
pkg/sbommanager/...test binaries compile for linux/amd64 and then fail to exec locally (exec format error); they need CI or a linux box.🤖 Generated with Claude Code