malcontent
malcontent copied to clipboard
chainguard-dev
#supply #chain #attack #detection
A lot of new functionality has been added around archives and the testing gaps were piling up. This PR covers a decent bit of the newly-added functionality by testing the...
Closes: https://github.com/chainguard-dev/bincapz/issues/209 This PR adds support for a `--version` flag that will either use the newly-added `VERSION` file or check for the `main.version` build key. Testing: ``` ❯ go run...
I think we should ship a v1.0.0 sooner rather than later, so I wanted to get an idea of what folks consider launch blockers. Here are my initial ideas: -...
With #174 we have transparent archive handling, but the output shows the temp file name: /var/folders/3g/88131l9j11x995ppjbxsvhbh0000gn/T/bincapz-apko_0.13.2_linux_arm64.tar.gz1015874883/apko_0.13.2_linux_arm64/apko What I think would be cool is if we can display the archive file...
bincapz consumed. >8GB of RAM using it against a large directory: ``` [24669.706944] Out of memory: Killed process 61135 (bincapz) total-vm:8580228kB, anon-rss:2136184kB, file-rss:0kB, shmem-rss:92kB, UID:1000 pgtables:13940kB oom_score_adj:0 [24676.379361] oom_reaper: reaped...
Map collections are not part of the JSON standard compliant. It'd be great to change the json output to use json objects instead of map collections.
I was looking for a version flag or command to get the product version but I didn't find anything.
bincapz's diff rename heuristics did not work in this PR: https://github.com/wolfi-dev/os/pull/18752 Added: /usr/lib/libgio-2.0.so.0.8000.1 Added: /usr/lib/libgirepository-2.0.so.0.8000.1 Added: /usr/lib/libglib-2.0.so.0.8000.1 Added: /usr/lib/libgmodule-2.0.so.0.8000.1 Added: /usr/lib/libgobject-2.0.so.0.8000.1 Added: /usr/lib/libgthread-2.0.so.0.8000.1 Modified: /usr/bin/gapplication Modified: /usr/bin/gdbus Modified: /usr/bin/gi-compile-repository Modified:...
Our Python rules didn't reliably match the use of "setuptools"; often we'll use the fact that the script is a library installer to up the suspicion level. This does add...
Similar to how we transparently decompress other archival formats, we should be able to run "upx -d" if a program appears to be compressed with UPX. We should probably show...