✨ Add origin version to debian packages

Some packages contain the version information for the source package. Where we can find it, we add it. Signed-off-by: Christian Zunker <[email protected]>
mondoohq · Feb 26, 2024 · 1c73764 · 1c73764
1 parent 39df8dc
commit 1c73764
Show file tree

Hide file tree

Showing 6 changed files with 53 additions and 20 deletions.
diff --git a/providers/os/resources/os.lr b/providers/os/resources/os.lr
@@ -616,6 +616,9 @@ package @defaults("name version") {
 
   // Package origin (optional)
   origin() string
+  // Package origin version (optional)
+  originVersion() string
+
 
   // Available version
   available string

diff --git a/providers/os/resources/os.lr.go b/providers/os/resources/os.lr.go
diff --git a/providers/os/resources/os.lr.manifest.yaml b/providers/os/resources/os.lr.manifest.yaml
@@ -587,6 +587,8 @@ resources:
       installed: {}
       name: {}
       origin: {}
+      originVersion:
+        min_mondoo_version: latest
       outdated: {}
       purl:
         min_mondoo_version: latest

diff --git a/providers/os/resources/packages.go b/providers/os/resources/packages.go
@@ -5,10 +5,11 @@ package resources
 
 import (
 	"errors"
-	"go.mondoo.com/cnquery/v10/types"
 	"regexp"
 	"sync"
 
+	"go.mondoo.com/cnquery/v10/types"
+
 	"github.com/rs/zerolog/log"
 	"go.mondoo.com/cnquery/v10/llx"
 	"go.mondoo.com/cnquery/v10/providers-sdk/v1/plugin"
@@ -74,6 +75,7 @@ func initPackage(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[str
 	res.Arch.State = plugin.StateIsSet | plugin.StateIsNull
 	res.Format.State = plugin.StateIsSet | plugin.StateIsNull
 	res.Origin.State = plugin.StateIsSet | plugin.StateIsNull
+	res.OriginVersion.State = plugin.StateIsSet | plugin.StateIsNull
 	res.Status.State = plugin.StateIsSet | plugin.StateIsNull
 	res.Files.State = plugin.StateIsSet | plugin.StateIsNull
 	return nil, res, nil
@@ -94,6 +96,10 @@ func (p *mqlPackage) origin() (string, error) {
 	return "", nil
 }
 
+func (p *mqlPackage) originVersion() (string, error) {
+	return "", nil
+}
+
 func (p *mqlPackage) files() ([]interface{}, error) {
 	if p.filesState == packages.PkgFilesNotAvailable {
 		return nil, nil
@@ -189,18 +195,19 @@ func (x *mqlPackages) list() ([]interface{}, error) {
 		}
 
 		pkg, err := CreateResource(x.MqlRuntime, "package", map[string]*llx.RawData{
-			"name":        llx.StringData(osPkg.Name),
-			"version":     llx.StringData(osPkg.Version),
-			"available":   llx.StringData(available),
-			"arch":        llx.StringData(osPkg.Arch),
-			"status":      llx.StringData(osPkg.Status),
-			"description": llx.StringData(osPkg.Description),
-			"format":      llx.StringData(osPkg.Format),
-			"installed":   llx.BoolData(true),
-			"origin":      llx.StringData(osPkg.Origin),
-			"epoch":       llx.StringData(osPkg.Epoch),
-			"purl":        llx.StringData(osPkg.PUrl),
-			"cpes":        llx.ArrayData(cpes, types.Resource("cpe")),
+			"name":          llx.StringData(osPkg.Name),
+			"version":       llx.StringData(osPkg.Version),
+			"available":     llx.StringData(available),
+			"arch":          llx.StringData(osPkg.Arch),
+			"status":        llx.StringData(osPkg.Status),
+			"description":   llx.StringData(osPkg.Description),
+			"format":        llx.StringData(osPkg.Format),
+			"installed":     llx.BoolData(true),
+			"origin":        llx.StringData(osPkg.Origin),
+			"originVersion": llx.StringData(osPkg.OriginVersion),
+			"epoch":         llx.StringData(osPkg.Epoch),
+			"purl":          llx.StringData(osPkg.PUrl),
+			"cpes":          llx.ArrayData(cpes, types.Resource("cpe")),
 		})
 		if err != nil {
 			return nil, err

diff --git a/providers/os/resources/packages/dpkg_packages.go b/providers/os/resources/packages/dpkg_packages.go
@@ -6,15 +6,16 @@ package packages
 import (
 	"bufio"
 	"fmt"
-	"github.com/package-url/packageurl-go"
-	"go.mondoo.com/cnquery/v10/providers-sdk/v1/inventory"
-	"go.mondoo.com/cnquery/v10/providers/os/resources/cpe"
-	"go.mondoo.com/cnquery/v10/providers/os/resources/purl"
 	"io"
 	"os"
 	"regexp"
 	"strings"
 
+	"github.com/package-url/packageurl-go"
+	"go.mondoo.com/cnquery/v10/providers-sdk/v1/inventory"
+	"go.mondoo.com/cnquery/v10/providers/os/resources/cpe"
+	"go.mondoo.com/cnquery/v10/providers/os/resources/purl"
+
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/afero"
 	"go.mondoo.com/cnquery/v10/providers/os/connection/shared"
@@ -25,7 +26,8 @@ const (
 )
 
 var (
-	DPKG_REGEX        = regexp.MustCompile(`^(.+):\s(.+)$`)
+	DPKG_REGEX = regexp.MustCompile(`^(.+):\s(.+)$`)
+	// e.g. source with version: samba (2:4.17.12+dfsg-0+deb12u1)
 	DPKG_ORIGIN_REGEX = regexp.MustCompile(`^\s*([^\(]*)(?:\((.*)\))?\s*$`)
 )
 
@@ -85,6 +87,10 @@ func ParseDpkgPackages(pf *inventory.Platform, input io.Reader) ([]Package, erro
 			} else {
 				log.Error().Str("origin", m[2]).Msg("cannot parse dpkg origin")
 			}
+			// Some packages also have a version as part of the Source field
+			if o != nil && len(o) >= 2 {
+				pkg.OriginVersion = strings.TrimSpace(o[2])
+			}
 		// description supports multi-line statements, start desc
 		case key == "Description":
 			pkg.Description = strings.TrimSpace(m[2])

diff --git a/providers/os/resources/packages/packages.go b/providers/os/resources/packages/packages.go
@@ -33,8 +33,9 @@ type Package struct {
 	// this may be the source package or an origin
 	// e.g. on alpine it is used for parent  packages
 	// o 	Package Origin - https://wiki.alpinelinux.org/wiki/Apk_spec
-	Origin string `json:"origin"`
-	Format string `json:"format"`
+	Origin        string `json:"origin"`
+	OriginVersion string `json:"originVersion"`
+	Format        string `json:"format"`
 
 	// Package Url follows https://github.com/package-url/purl-spec
 	PUrl string `json:"purl,omitempty"`