Update semver_dialects gem to support rpm operating system package versions
Proposal
In order to fully support Continuous Vulnerability Scans for Container Scanning advisories, we need to be able to compare the package versions for the following operating system purl types: deb, apk, rpm. Support for these purl types will be implemented by the following issues:
- Update semver_dialects gem to support deb opera... (#427961 - closed) • Nick Ilieskou • 16.6 • On track
- Update semver_dialects gem to support apk opera... (#428703 - closed) • Shao Ming Tan • 17.2 • On track
- Update semver_dialects gem to support rpm opera... (#428941 - closed) • Shao Ming Tan • 17.2 • On track (this issue)
The purpose of this issue is to add initial support for comparing package versions for the rpm purl type to the semver_dialects gem.
Implementation Plan
As it's no longer viable to reuse the Maven logic, here's the updated implementation plan:
-
Create a new class RpmVersionthat inherits fromVersion. -
Implement the VersionParser.parsemethod to parse raw version strings using logic ingo-rpm-version. -
Override the <=>method using logic ingo-rpm-version. -
Override the to_smethod using logic ingo-rpm-version. -
Port over tests from go-rpm-versionand ensure they are passing -
Port over rpm test cases -
Test if deb_versionpasses the rpm test cases and go-rpm-version test cases to -
Tested that the deb_versionlibrary does not parse rpm versions. -
Extracted rpmvercmp into it's own command to aid with testing. -
Update Add rpm support (gitlab-org/ruby/gems/semver_dialects!69 - merged) to reference the rpm implementation instead. -
Found a discrepancy with rpm implementation that ignores dot character. As such to_smethod is unable to recreate version string after parsing. -
Decided to defer caret support as too complicated and not widely used. -
MR review
-
-
Update the os_pkg_version_sat?method so that it handles therpmPURL type using the version comparison. -
Once semver_dialectsis released with version containing rpm support, create MR in rails monolith to add rpm to supported CS purl types and bumpsemver_dialectsversion. -
Update documentation to note support for rpm.
NOTE: Support for Red Hat advisory comparisons is out of scope and tracked in Add support for Red Hat advisory scans (#443720)
Edited by Shao Ming Tan