From 2ffc3c95de981c5833cd1dfa1ca04e21688b02ba Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 24 Sep 2026 16:51:48 +0200 Subject: [PATCH 1/6] chore: bump sysdig-cli-scanner to 1.30.1 and automate it in just update --- AGENTS.md | 6 ++++++ Justfile | 12 ++++++++++++ flake.nix | 2 ++ src/infra/scanner_binary_manager.rs | 4 ++-- 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 2ff538b..f57c577 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -180,6 +180,12 @@ The project uses `just` as a command runner to encapsulate common workflows. * `just fix` * Runs `cargo fix` and `cargo machete` / `cargo machete --fix` to clean up unused dependencies and minor issues. +* `just update` + * Updates flake inputs, Cargo deps and pre-commit hooks, and runs `just update-cli-scanner`. + +* `just update-cli-scanner` + * Bumps the pinned Sysdig CLI scanner version in `src/infra/scanner_binary_manager.rs` to the latest release. It rewrites the lines tagged with `newest-version-marker`; do not remove those markers. + Additional helpful commands: * `cargo test -- --nocapture` – run tests with full output when debugging. diff --git a/Justfile b/Justfile index c160380..0c7b835 100644 --- a/Justfile +++ b/Justfile @@ -20,3 +20,15 @@ update: nix flake update nix develop --command cargo update nix develop --command pre-commit autoupdate + nix develop --command just update-cli-scanner + +# Bump the pinned sysdig-cli-scanner to the latest version (lines tagged with newest-version-marker) +update-cli-scanner: + #!/usr/bin/env bash + set -euo pipefail + latest=$(curl --silent --show-error --fail --location https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt | tr -d '[:space:]') + IFS=. read -r major minor patch <<< "$latest" + file=src/infra/scanner_binary_manager.rs + sd 'Version::new\(\d+, \d+, \d+\)(.*newest-version-marker)' "Version::new($major, $minor, $patch)\${1}" "$file" + sd '"\d+\.\d+\.\d+"(.*newest-version-marker)' "\"$latest\"\${1}" "$file" + echo "sysdig-cli-scanner -> $latest" diff --git a/flake.nix b/flake.nix index e49561f..5d78d1f 100644 --- a/flake.nix +++ b/flake.nix @@ -45,12 +45,14 @@ cargo-nextest cargo-tarpaulin clippy + curl just lldb pre-commit rust-analyzer rustc rustfmt + sd ]; inputsFrom = [ sysdig-lsp ]; diff --git a/src/infra/scanner_binary_manager.rs b/src/infra/scanner_binary_manager.rs index b0017f9..4ddaa3d 100644 --- a/src/infra/scanner_binary_manager.rs +++ b/src/infra/scanner_binary_manager.rs @@ -44,7 +44,7 @@ pub(super) struct ScannerBinaryManager {} impl ScannerBinaryManager { const fn version(&self) -> Version { - Version::new(1, 23, 0) + Version::new(1, 30, 1) // newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner` } pub async fn install_expected_version_if_not_present( @@ -197,7 +197,7 @@ mod tests { async fn it_gets_the_wanted_version() { let mgr = ScannerBinaryManager::default(); - assert_eq!(mgr.version().to_string(), "1.23.0"); + assert_eq!(mgr.version().to_string(), "1.30.1"); // newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner` } #[tokio::test] From 7125b686998ea7223a32b128495df7f52da40e24 Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 24 Sep 2026 17:15:15 +0200 Subject: [PATCH 2/6] test: compare installed scanner version against the pinned one --- src/infra/scanner_binary_manager.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/infra/scanner_binary_manager.rs b/src/infra/scanner_binary_manager.rs index 4ddaa3d..2f6c3dc 100644 --- a/src/infra/scanner_binary_manager.rs +++ b/src/infra/scanner_binary_manager.rs @@ -237,7 +237,7 @@ mod tests { .await .unwrap() .to_string(), - "1.23.0" + mgr.version().to_string() ); } @@ -260,7 +260,7 @@ mod tests { .await .unwrap() .to_string(), - "1.23.0" + mgr.version().to_string() ); } } From e47314bdf6a57a687487c364faacedba70ec0843 Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 24 Sep 2026 17:19:20 +0200 Subject: [PATCH 3/6] chore: release 0.9.1 --- Cargo.lock | 2 +- Cargo.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f2353f9..8fc394e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1994,7 +1994,7 @@ dependencies = [ [[package]] name = "sysdig-lsp" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-trait", "bollard", diff --git a/Cargo.toml b/Cargo.toml index 0ec4f5d..c52ae00 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "sysdig-lsp" -version = "0.9.0" +version = "0.9.1" edition = "2024" authors = [ "Sysdig Inc." ] readme = "README.md" From ec8d3651213a05d822b0d16b113d3f3f662d40a5 Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 24 Sep 2026 17:25:57 +0200 Subject: [PATCH 4/6] fix(scanner): tolerate unknown package types in scan results --- .../sysdig_image_scanner_json_scan_result_v1.rs | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs index bd96f9f..5be46a2 100644 --- a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs +++ b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs @@ -372,7 +372,9 @@ pub(super) enum JsonPackageType { Ruby, #[serde(rename = "rust")] Rust, + // Newer scanners add package types (e.g. `oci`); don't fail the whole report on them. #[default] + #[serde(other)] Unknown, } @@ -456,6 +458,7 @@ pub(super) enum JsonRiskAcceptReason { RiskNotRelevant, Custom, #[default] + #[serde(other)] Unknown, } @@ -572,7 +575,9 @@ pub(super) struct JsonVulnerability { mod tests { use crate::{ domain::scanresult::{scan_result::ScanResult, severity::Severity}, - infra::sysdig_image_scanner_json_scan_result_v1::JsonScanResultV1, + infra::sysdig_image_scanner_json_scan_result_v1::{ + JsonPackageType, JsonRiskAcceptReason, JsonScanResultV1, + }, }; #[test] @@ -672,4 +677,13 @@ mod tests { assert!(found_layer.is_some(), "Should find layer by valid digest"); assert_eq!(found_layer.unwrap().digest(), Some(digest)); } + + #[test] + fn it_maps_unknown_enum_values_to_unknown() { + let package_type: JsonPackageType = serde_json::from_str(r#""oci""#).unwrap(); + assert!(matches!(package_type, JsonPackageType::Unknown)); + + let reason: JsonRiskAcceptReason = serde_json::from_str(r#""SomethingNew""#).unwrap(); + assert!(matches!(reason, JsonRiskAcceptReason::Unknown)); + } } From a6665cb5241661f93ca10e657bd699b032d9dba7 Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 24 Sep 2026 17:35:21 +0200 Subject: [PATCH 5/6] fix(scanner): support the oci package type instead of ignoring unknown ones --- src/domain/scanresult/package_type.rs | 2 ++ ...ysdig_image_scanner_json_scan_result_v1.rs | 19 ++++++++----------- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/src/domain/scanresult/package_type.rs b/src/domain/scanresult/package_type.rs index 13cceec..60bff57 100644 --- a/src/domain/scanresult/package_type.rs +++ b/src/domain/scanresult/package_type.rs @@ -12,6 +12,7 @@ pub enum PackageType { Ruby, Php, CSharp, + Oci, } impl Display for PackageType { @@ -30,6 +31,7 @@ impl Display for PackageType { PackageType::Ruby => "ruby", PackageType::Php => "php", PackageType::CSharp => "csharp", + PackageType::Oci => "oci", } ) } diff --git a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs index 5be46a2..df875cb 100644 --- a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs +++ b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs @@ -372,9 +372,9 @@ pub(super) enum JsonPackageType { Ruby, #[serde(rename = "rust")] Rust, - // Newer scanners add package types (e.g. `oci`); don't fail the whole report on them. + #[serde(rename = "oci")] + Oci, #[default] - #[serde(other)] Unknown, } @@ -390,6 +390,7 @@ impl From for PackageType { JsonPackageType::Python => Self::Python, JsonPackageType::Ruby => Self::Ruby, JsonPackageType::Rust => Self::Rust, + JsonPackageType::Oci => Self::Oci, JsonPackageType::Unknown => Self::Unknown, } } @@ -458,7 +459,6 @@ pub(super) enum JsonRiskAcceptReason { RiskNotRelevant, Custom, #[default] - #[serde(other)] Unknown, } @@ -574,10 +574,10 @@ pub(super) struct JsonVulnerability { #[cfg(test)] mod tests { use crate::{ - domain::scanresult::{scan_result::ScanResult, severity::Severity}, - infra::sysdig_image_scanner_json_scan_result_v1::{ - JsonPackageType, JsonRiskAcceptReason, JsonScanResultV1, + domain::scanresult::{ + package_type::PackageType, scan_result::ScanResult, severity::Severity, }, + infra::sysdig_image_scanner_json_scan_result_v1::{JsonPackageType, JsonScanResultV1}, }; #[test] @@ -679,11 +679,8 @@ mod tests { } #[test] - fn it_maps_unknown_enum_values_to_unknown() { + fn it_deserializes_the_oci_package_type() { let package_type: JsonPackageType = serde_json::from_str(r#""oci""#).unwrap(); - assert!(matches!(package_type, JsonPackageType::Unknown)); - - let reason: JsonRiskAcceptReason = serde_json::from_str(r#""SomethingNew""#).unwrap(); - assert!(matches!(reason, JsonRiskAcceptReason::Unknown)); + assert_eq!(PackageType::from(package_type), PackageType::Oci); } } From 8ea2fd13c6e00725bb30f286b84c075bb7edced4 Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 24 Sep 2026 17:42:29 +0200 Subject: [PATCH 6/6] fix(scanner): support the Software Runtime package type --- src/domain/scanresult/package_type.rs | 2 ++ .../sysdig_image_scanner_json_scan_result_v1.rs | 16 ++++++++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/src/domain/scanresult/package_type.rs b/src/domain/scanresult/package_type.rs index 60bff57..ca65ba2 100644 --- a/src/domain/scanresult/package_type.rs +++ b/src/domain/scanresult/package_type.rs @@ -13,6 +13,7 @@ pub enum PackageType { Php, CSharp, Oci, + SoftwareRuntime, } impl Display for PackageType { @@ -32,6 +33,7 @@ impl Display for PackageType { PackageType::Php => "php", PackageType::CSharp => "csharp", PackageType::Oci => "oci", + PackageType::SoftwareRuntime => "software runtime", } ) } diff --git a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs index df875cb..f47509c 100644 --- a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs +++ b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs @@ -374,6 +374,8 @@ pub(super) enum JsonPackageType { Rust, #[serde(rename = "oci")] Oci, + #[serde(rename = "Software Runtime")] + SoftwareRuntime, #[default] Unknown, } @@ -391,6 +393,7 @@ impl From for PackageType { JsonPackageType::Ruby => Self::Ruby, JsonPackageType::Rust => Self::Rust, JsonPackageType::Oci => Self::Oci, + JsonPackageType::SoftwareRuntime => Self::SoftwareRuntime, JsonPackageType::Unknown => Self::Unknown, } } @@ -678,9 +681,14 @@ mod tests { assert_eq!(found_layer.unwrap().digest(), Some(digest)); } - #[test] - fn it_deserializes_the_oci_package_type() { - let package_type: JsonPackageType = serde_json::from_str(r#""oci""#).unwrap(); - assert_eq!(PackageType::from(package_type), PackageType::Oci); + #[rstest::rstest] + #[case(r#""oci""#, PackageType::Oci)] + #[case(r#""Software Runtime""#, PackageType::SoftwareRuntime)] + fn it_deserializes_package_types_added_in_newer_scanners( + #[case] json: &str, + #[case] expected: PackageType, + ) { + let package_type: JsonPackageType = serde_json::from_str(json).unwrap(); + assert_eq!(PackageType::from(package_type), expected); } }