feat: Scan Homebrew inventory using git repository metadata by Avgor46 · Pull Request #2510 · google/osv-scanner

Avgor46 · 2026-02-11T17:55:54Z

Hi!

In this PR, I've tried to provide a way of scanning homebrew inventories.

It refers to issues in scalibr and scanner.

codecov-commenter · 2026-02-11T19:26:29Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.60%. Comparing base (89bf42d) to head (0b46fd8).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2510      +/-   ##
==========================================
- Coverage   71.67%   71.60%   -0.07%     
==========================================
  Files         164      164              
  Lines       12081    12090       +9     
==========================================
- Hits         8659     8657       -2     
- Misses       2794     2805      +11     
  Partials      628      628

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

another-rex · 2026-02-18T04:50:34Z

Sorry for the delay in review, this is still on my radar, I will try to get around to it this week!

another-rex

Nice! Looks great! One thing that could make this better is to add a docker image that uses homebrew itself to add the package (we can pin it to a specific version), and then we scan that image. (As a test under scan image

another-rex · 2026-02-24T04:35:22Z

internal/imodels/imodels.go

+			newEco, err := osvecosystem.Parse("GIT")
+			if err != nil {
+				cmdlogger.Warnf("Warning: error parsing osvscanner.json ecosystem: %s", err.Error())
+				return eco
+			}


I think this error message is incorrect, we should use MustParse here (if available, or just panic), no need to error since GIT should always successfully parse.

Using MustParse solves this

another-rex · 2026-02-24T05:02:39Z

internal/imodels/imodels.go

+	// Special case for Homebrew where we check if the source code repo is set, and if so, we set the ecosystem to GIT
+	// since Homebrew doesn't have a defined ecosystem in OSV, but if we have a source code repo,
+	// it's likely that the vulnerabilities will be associated with the source code repo and not the Homebrew package itself
+	if _, ok := pkg.Metadata.(*homebrewmetadata.Metadata); ok {


I think this whole thing can be more generic, if eco is empty, but source code repo name is filled out, it should just return the GIT ecosystem.

Avgor46 · 2026-02-26T18:52:20Z

Nice! Looks great! One thing that could make this better is to add a docker image that uses homebrew itself to add the package (we can pin it to a specific version), and then we scan that image. (As a test under scan image

Could be done after scalibr PR

Avgor46 · 2026-04-03T15:46:27Z

I've added image test and updated some snapshots. It works locally, but CI is red in my fork. Not all tests work properly on my Ubuntu system, so how can I update the snapshots belonging only to my new test?

G-Rath · 2026-04-03T19:09:23Z

You can use -run to run specific tests i.e.

# runs just the one est
UPDATE_SNAPS=true go test ./cmd/osv-scanner/scan/... -run 'TestCommand_OCIImage/scanning_ubuntu_image_with_homebrew_extractor'

# runs a collection subtests
UPDATE_SNAPS=true go test ./cmd/osv-scanner/scan/... -run 'TestCommand_HomebrewWithAnnotators'

Not all tests work properly on my Ubuntu system

let us know if this is not related to your specific setup, as the majority of the test suite should be runnable on standard Ubuntu and friends without any extra setup

(there are a few "exotic" tests like for Rust reachability which requires Rust, but they shouldn't be in the cmd tests)

Avgor46 · 2026-04-04T10:22:44Z

Thanks, @G-Rath. I've fixed an issue. It seems that the tests related to this PR are now working.

another-rex

This looks great!

Apart from that comment on the dockerfile, LGTM.

another-rex · 2026-04-06T22:47:00Z

cmd/osv-scanner/scan/image/testdata/test-ubuntu-homebrew.Dockerfile

+USER linuxbrew
+WORKDIR /home/linuxbrew
+
+RUN /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"


I'm a bit concerned about running an unpinned bash script just from the internet, we want to be as deterministic as possible in our tests to avoid it from changing the scan results without us changing the test files.

Pinning the official docker image for homebrew might be better, something like this

FROM ghcr.io/homebrew/ubuntu22.04:5.1.4@sha256:6b3c4bc0a7128cf5a78d2e641da6e88ac4195714e1315c4d2b522532d7fb1e7a USER linuxbrew WORKDIR /home/linuxbrew ENV HOMEBREW_NO_AUTO_UPDATE=1 \ NONINTERACTIVE=1 # Install vulnerable package RUN brew install cjson # Make it vulnerable :) RUN mv .linuxbrew/Cellar/cjson/* .linuxbrew/Cellar/cjson/1.7.17

I used the raw homebrew installation as stated in the docs because the official homebrew image is heavy (up to 2 GB) and it takes extra time to run CI (prepare_test_image_testdata check: 4 minutes vs 7 minutes with ghcr.io/homebrew). I replaced the Dockerfile with the suggested one, and it seems to be working too.

another-rex

Thanks!

…ecosystem

another-rex · 2026-04-08T03:48:14Z

internal/imodels/imodels.go

+	// If ecosystem is empty and the source code repo is set we set the ecosystem to GIT
+	// since it's likely that the vulnerabilities will be associated with the source code repo
+	if eco.Ecosystem == "" && pkg.SourceCode != nil {
+		eco = osvecosystem.MustParse("GIT")


Was wondering why the tests are failing. Turns out our offline scanning has an assumption that Git repos have no ecosystem rather than GIT.

Pushed a fix for this and updated the snapshots

Ly-Joey requested a review from another-rex February 16, 2026 00:06

another-rex reviewed Feb 24, 2026

View reviewed changes

Avgor46 force-pushed the main branch from 3cc849b to fc80ca4 Compare February 26, 2026 14:49

Avgor46 force-pushed the main branch from fc80ca4 to 1541db0 Compare April 3, 2026 13:55

feat: Scan Homebrew inventory using git repository metadata

dc6ab27

Avgor46 force-pushed the main branch 2 times, most recently from 19ede27 to 65e4dc2 Compare April 3, 2026 15:40

Avgor46 requested a review from another-rex April 3, 2026 15:46

Avgor46 force-pushed the main branch from 65e4dc2 to 98fa490 Compare April 4, 2026 10:03

Avgor46 force-pushed the main branch from 98fa490 to c19ef9a Compare April 4, 2026 10:28

another-rex reviewed Apr 6, 2026

View reviewed changes

test: Add test for homebrew scanning

c51e81c

Avgor46 force-pushed the main branch 2 times, most recently from f945d21 to 2e746b6 Compare April 7, 2026 21:37

test: update snapshots

da28398

Avgor46 force-pushed the main branch from 2e746b6 to da28398 Compare April 7, 2026 22:15

Avgor46 requested a review from another-rex April 7, 2026 22:40

another-rex approved these changes Apr 7, 2026

View reviewed changes

Fix snapshots and fix pkgEcosystem offline matching with the new GIT …

0b46fd8

…ecosystem

another-rex reviewed Apr 8, 2026

View reviewed changes

another-rex merged commit ed9dc27 into google:main Apr 9, 2026
17 checks passed

Conversation

Avgor46 commented Feb 11, 2026

Uh oh!

codecov-commenter commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

another-rex commented Feb 18, 2026

Uh oh!

another-rex left a comment

Choose a reason for hiding this comment

Uh oh!

another-rex Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Avgor46 Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

another-rex Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Avgor46 Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Avgor46 commented Feb 26, 2026

Uh oh!

Avgor46 commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

G-Rath commented Apr 3, 2026

Uh oh!

Avgor46 commented Apr 4, 2026

Uh oh!

another-rex left a comment

Choose a reason for hiding this comment

Uh oh!

another-rex Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Avgor46 Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

another-rex left a comment

Choose a reason for hiding this comment

Uh oh!

another-rex Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Feb 11, 2026 •

edited

Loading

another-rex Feb 24, 2026 •

edited

Loading

Avgor46 commented Apr 3, 2026 •

edited

Loading