Fix Traefik version detection across architectures

syft/pkg/cataloger/binary/classifier_cataloger_test.go

@@ -6,6 +6,8 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"os"
+	"path/filepath"
 	"slices"
 	"strings"
 	"testing"
@@ -374,6 +376,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("traefik-binary"),
 			},
 		},
+		{
+			logicalFixture: "traefik/2.10.5/linux-s390x",
+			expected: pkg.Package{
+				Name:      "traefik",
+				Version:   "2.10.5",
+				Type:      "binary",
+				PURL:      "pkg:generic/traefik@2.10.5",
+				Locations: locations("traefik"),
+				Metadata:  metadata("traefik-binary"),
+			},
+		},
 		{
 			logicalFixture: "traefik/2.10.7/linux-amd64",
 			expected: pkg.Package{
@@ -385,6 +398,28 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("traefik-binary"),
 			},
 		},
+		{
+			logicalFixture: "traefik/2.11.10/linux-ppc64le",
+			expected: pkg.Package{
+				Name:      "traefik",
+				Version:   "2.11.10",
+				Type:      "binary",
+				PURL:      "pkg:generic/traefik@2.11.10",
+				Locations: locations("traefik"),
+				Metadata:  metadata("traefik-binary"),
+			},
+		},
+		{
+			logicalFixture: "traefik/2.11.30/linux-amd64",
+			expected: pkg.Package{
+				Name:      "traefik",
+				Version:   "2.11.30",
+				Type:      "binary",
+				PURL:      "pkg:generic/traefik@2.11.30",
+				Locations: locations("traefik"),
+				Metadata:  metadata("traefik-binary"),
+			},
+		},
 		{
 			logicalFixture: "traefik/3.0.4/linux-riscv64",
 			expected: pkg.Package{
@@ -407,6 +442,17 @@ func Test_Cataloger_PositiveCases(t *testing.T) {
 				Metadata:  metadata("traefik-binary"),
 			},
 		},
+		{
+			logicalFixture: "traefik/3.6.6/linux-arm-v6",
+			expected: pkg.Package{
+				Name:      "traefik",
+				Version:   "3.6.6",
+				Type:      "binary",
+				PURL:      "pkg:generic/traefik@3.6.6",
+				Locations: locations("traefik"),
+				Metadata:  metadata("traefik-binary"),
+			},
+		},
 		{
 			logicalFixture: "memcached/1.6.18/linux-amd64",
 			expected: pkg.Package{
@@ -3009,6 +3055,26 @@ func Test_Cataloger_DefaultClassifiers_PositiveCases_Image(t *testing.T) {
 	}
 }
 
+func TestTraefikClassifierPrefersVersionData(t *testing.T) {
+	dir := t.TempDir()
+	// Traefik 2.10.5 on s390x contains a dependency version before its own version data,
+	// followed by other multi-NUL-terminated version strings.
+	contents := []byte("\x00group\x002.7.0\x00%s,%s\xbe\xb0\x8f\xf92.10.5\x00\x00\x00\x00\x00\x000.0.721\x00\x00\x001.21.3\x00\x00")
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "traefik"), contents, 0o600))
+
+	c := NewClassifierCataloger(DefaultClassifierCatalogerConfig())
+	src, err := directorysource.NewFromPath(dir)
+	require.NoError(t, err)
+
+	resolver, err := src.FileResolver(source.SquashedScope)
+	require.NoError(t, err)
+
+	packages, _, err := c.Catalog(context.Background(), resolver)
+	require.NoError(t, err)
+	require.Len(t, packages, 1)
+	assert.Equal(t, "2.10.5", packages[0].Version)
+}
+
 func TestClassifierCataloger_DefaultClassifiers_NegativeCases(t *testing.T) {
 	c := NewClassifierCataloger(DefaultClassifierCatalogerConfig())
 

syft/pkg/cataloger/binary/classifiers.go

@@ -281,11 +281,17 @@ func DefaultClassifiers() []binutils.Classifier {
 		{
 			Class:    "traefik-binary",
 			FileGlob: "**/traefik",
-			EvidenceMatcher: m.FileContentsVersionMatcher(
-				// [NUL]v1.7.34[NUL]
-				// [NUL]2.9.6[NUL]
-				// 3.0.4[NUL]
-				`(?m)(\x00v?|\x{FFFD}.?)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha[0-9]|-beta[0-9]|-rc[0-9])?)\x00`),
+			EvidenceMatcher: binutils.MatchAny(
+				// Keep this before the legacy matcher: some s390x builds contain an earlier dependency version.
+				// The Traefik version has no stable cross-platform prefix, but is the first semver followed by multiple NULs.
+				m.FileContentsVersionMatcher(
+					`(?m)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha[0-9]|-beta[0-9]|-rc[0-9])?)\x00{2,}`),
+				m.FileContentsVersionMatcher(
+					// [NUL]v1.7.34[NUL]
+					// [NUL]2.9.6[NUL]
+					// 3.0.4[NUL]
+					`(?m)(\x00v?|\x{FFFD}.?)(?P<version>[0-9]+\.[0-9]+\.[0-9]+(-alpha[0-9]|-beta[0-9]|-rc[0-9])?)\x00`),
+			),
 			Package: "traefik",
 			PURL:    mustPURL("pkg:generic/traefik@version"),
 			CPEs:    singleCPE("cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", cpe.NVDDictionaryLookupSource),

syft/pkg/cataloger/binary/testdata/config.yaml

@@ -751,13 +751,34 @@ from-images:
     paths:
       - /usr/local/bin/traefik
 
+  - version: 2.10.5
+    images:
+      - ref: traefik:v2.10.5@sha256:0ac60f2c2f4a9564d06dfe1b9f68d47457142d947714c6367d6e2063346c79f9
+        platform: linux/s390x
+    paths:
+      - /usr/local/bin/traefik
+
   - version: 2.10.7
     images:
       - ref: traefik:2.10.7@sha256:a98415716a91066ef5e442969887ebb3df7d80775b5bfa7b67fcaed989833d84
         platform: linux/amd64
     paths:
       - /usr/local/bin/traefik
 
+  - version: 2.11.10
+    images:
+      - ref: traefik:v2.11.10@sha256:b271577cf5521c880a3eafab8df2bd2348ad77128b0a146802be63084fb4e746
+        platform: linux/ppc64le
+    paths:
+      - /usr/local/bin/traefik
+
+  - version: 2.11.30
+    images:
+      - ref: traefik:v2.11.30@sha256:1332aeea1523caaac64bc7406c29fc64251fa094ceb7bfb07bc2cb0b8f529f5f
+        platform: linux/amd64
+    paths:
+      - /usr/local/bin/traefik
+
   - version: 3.0.4
     images:
       - ref: traefik:3.0.4@sha256:12a7cc4232b5b7fe027673da8c096144525f59a8eabc87e52260aac0ec5a1219
@@ -772,6 +793,13 @@ from-images:
     paths:
       - /usr/local/bin/traefik
 
+  - version: 3.6.6
+    images:
+      - ref: traefik:v3.6.6@sha256:5457c0a157f7ed95be8253228daf32bba1a12ae1db68ba0337fee123623c347c
+        platform: linux/arm/v6
+    paths:
+      - /usr/local/bin/traefik
+
   # from the original dynamic fixtures...
 
   - name: python-rhel-shared-libs