[sleepy-slothh]

Related issue: #39900

Summary

Issue #39900 identified Ubuntu OSV binary package mappings as a required part of the OSV migration. The current processor reads the source package name but does not deserialize or emit package names from ecosystem_specific.binaries, which can result in false negatives for installed binary packages whose names differ from their source package.

Canonical Ubuntu OSV records identify the affected source package in affected.package.name and provide installed binary package names under affected.ecosystem_specific.binaries.

Example:

• Source package: libssh2
• Installed binary package: libssh2-1t64

This is an unreleased bug fix for #39900. The fix is generic and does not contain libssh2- or t64-specific matching logic.

Changes

• Parses Ubuntu ecosystem_specific.binaries.
• Emits binary package names as additional Ubuntu artifact keys.
• Preserves source package keys.
• Ignores empty binary package names.
• Deduplicates package names while preserving deterministic order.
• Adds/updates tests for binary expansion, duplicate names, empty names, nil ecosystem-specific data, and ordering.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Automated:

go test ./cmd/osv-processor -v

Result: PASS.

Manual artifact generation:

• Canonical record: CVE-2025-15661
• Ubuntu release: 26.04
• Generated result: Ubuntu 26.04: 2 packages, 1 CVEs
• Artifact contains both libssh2 and libssh2-1t64
• Generated libssh2-1t64 entry resolves in 1.11.1-1ubuntu0.26.04.2
• Vulnerable versions include 1.11.1-1ubuntu0.26.04.1

Summary by CodeRabbit

• Bug Fixes

  • Fixed Ubuntu vulnerability detection for installed binary packages when binary names differ from their corresponding source package names.
  • Enhanced vulnerability artifact generation to include matching Ubuntu binary package identifiers and to skip creating artifacts when no packages are found.

• New Features

  • Added support for Ubuntu binary-level details in vulnerability parsing and processing.

• Tests

  • Added unit and integration coverage for Ubuntu binary expansion, deduplication, handling missing Ubuntu metadata, and correct artifact output.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: da16fd6f-f0ff-4dd8-91de-9633db16780b

📥 Commits

Reviewing files that changed from the base of the PR and between 663e6a0 and a4a1d2e.

📒 Files selected for processing (5)

• changes/ubuntu-osv-binary-package-names
• cmd/osv-processor/main.go
• cmd/osv-processor/main_test.go
• cmd/osv-processor/transforms.go
• cmd/osv-processor/transforms_test.go

🚧 Files skipped from review as they are similar to previous changes (4)

• changes/ubuntu-osv-binary-package-names
• cmd/osv-processor/transforms.go
• cmd/osv-processor/transforms_test.go
• cmd/osv-processor/main.go

---

Walkthrough

Ubuntu OSV processing now parses EcosystemSpecific.Binaries entries containing binary names and versions. The Ubuntu artifact-generation loop augments transformed package lists with deduplicated binary names before writing vulnerability artifacts and deltas, and skips empty results. Unit tests cover expansion, nil ecosystem data, duplicate names, and empty binary names. A changelog entry documents the fix.

Possibly related PRs

• fleetdm/fleet#49399: Updates the OSV parsing model and EcosystemSpecific handling in the same processor.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 28.57% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: fixing Ubuntu OSV binary package matching.
Description check	✅ Passed	The description follows the template well and includes issue link, summary, changes, checklist, and testing details.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.95%. Comparing base (0786a5c) to head (2d16f6e).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main   #49816    +/-   ##
========================================
  Coverage   67.95%   67.95%            
========================================
  Files        3922     3908    -14     
  Lines      250011   249999    -12     
  Branches    13140    13334   +194     
========================================
- Hits       169888   169881     -7     
+ Misses      64831    64823     -8     
- Partials    15292    15295     +3     

Flag	Coverage Δ
backend	69.35% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[juan-fdz-hawa]

Thanks for the contribution! Could you share a few examples of the false negatives this aims to fix?

[sleepy-slothh]

Sure! The concrete false negative that led me to this was libssh2 on Ubuntu 26.04.

For UBUNTU-CVE-2025-15661, the Canonical OSV record has:

• source package: libssh2
• binary package: libssh2-1t64

Before this change, the OSV processor only generated an artifact key for the source package name libssh2. Since the host package is called libssh2-1t64, there is no package-name match, so the CVE is missed.

With this change, the artifact contains keys for both libssh2 and libssh2-1t64, so the installed binary package resolves correctly.

I also looked for other examples of the same source/binary split in Canonical's OSV data. For example:

• UBUNTU-CVE-2026-11586: source curl, with binaries including curl, libcurl3t64-gnutls, and libcurl4t64
• UBUNTU-CVE-2025-3277: source sqlite3, with binaries including sqlite3, libsqlite3-0, libsqlite3-tcl, etc.

So the issue isn't specific to libssh2 or t64: in general, when Fleet inventories an installed Ubuntu binary package whose name differs from the corresponding source package name, source-only artifact generation can result in the vulnerability not being matched.

[juan-fdz-hawa]

Thanks for reporting this! I've created #52218 to keep track of this. Unfortunately, we will follow a different approach for fixing this, so I'll be closing this.