fix(bear): BOM-root self-skip never matched - exact purl instead of regex-in-substring - #37
Open
taleodor-claude wants to merge 4 commits into
Open
fix(bear): BOM-root self-skip never matched - exact purl instead of regex-in-substring#37taleodor-claude wants to merge 4 commits into
taleodor-claude wants to merge 4 commits into
Conversation
… match Two bugs in the bitnami / tag-as-digest path, both reachable from a plain `devops replacetags` run. An image block written as separate registry / repository / tag keys is claimed by validateAndParseBitnamiLines, which then only emits lines when it found a substitution for that image. With no match it returned an empty slice while still reporting the block as handled, so the caller took it at its word and the entire block vanished from the output -- comments, pullPolicy, pullSecrets and all. It is silent, and the file still parses afterwards, so it surfaces later as the chart quietly falling back to whatever the subchart ships. That is not hypothetical: running replacetags over the ReARM chart's own values with a tag source that happens not to carry the postgres image drops 21 lines of postgresql.image. Any chart processed with a partial tag source is exposed. Such a block is now handed back unclaimed, so it goes through the normal line-by-line path like any other content -- preserved, and still open to property and secret resolution. Second, a source reference carrying a digest but no tag produced `tag: @sha256:...`, which is not a valid reference. Charts that take a digest through the tag field accept a bare `sha256:...`, so that is what is written when there is no tag to combine. Both new tests fail without the fix. The existing nine still pass, so the full-bitnami and sha-field shapes are unaffected. ReARM-Agentic-Session: 9083aa16-4486-4bc0-8fc4-0eb6e6783f33 ReARM-Agent: 703fbe71-5a15-4bd3-b601-ce3f0d7d225b
… regex-in-substring addMetadataComponentToSkipPatterns appended ".*<name>.*" to skipPatterns, but shouldSkipPurl matches by substring, never regex - so the pattern could only match a purl containing the literal characters ".*", and the root component was enriched despite the intent. Register the root's full purl for an exact (case-insensitive) match instead. Exact rather than substring is deliberate: a substring of the root's purl would also skip other versions of the same package appearing as real dependencies (pkg:npm/a@1.0 is a substring of pkg:npm/a@1.0.1), and a substring of just the name would skip every component whose purl merely contains it. ReARM-Agentic-Session: 909a0a70-a1f9-400c-8584-dc30130fa04c ReARM-Agent: 703fbe71-5a15-4bd3-b601-ce3f0d7d225b Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…erified healthy) ReARM-Agentic-Session: 909a0a70-a1f9-400c-8584-dc30130fa04c ReARM-Agent: 703fbe71-5a15-4bd3-b601-ce3f0d7d225b Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
addMetadataComponentToSkipPatternsappended.*<name>.*toskipPatterns— regex syntax fed intoshouldSkipPurl, which matches by substring (strings.Contains), never as a regex. A substring can only match a purl containing the literal characters.*, so the BOM-root self-skip has never fired: the root component was sent to BEAR for enrichment as if it were one of its own dependencies.Fix
Register the metadata component's full purl for an exact (case-insensitive) match in a new
rootSkipPurlslist checked byshouldSkipPurlahead of the substring patterns. Exact rather than substring is deliberate, and the choice is documented on the var:pkg:npm/a@1.0is a substring ofpkg:npm/a@1.0.1);appvsapplication).--skipPatternsubstring semantics are unchanged. The purl parse (previously used only to extract the name) is gone, along with the now-unusedpackageurl-goimport in this file.Found during review of relizaio/rearm#288 (rebom built-in skip patterns); backend wiring to follow separately.
Verification
cmd/bear_test.go: exact match (incl. case-insensitivity), the two over-skip cases above, missing-metadata tolerance, and unchanged--skipPatternsubstring behavior.go build ./...,go test ./...all green,go vetclean.🤖 Generated with Claude Code