From d5d87308d4bb6ae761bdb996db773f89de042026 Mon Sep 17 00:00:00 2001 From: mzfr Date: Fri, 29 Aug 2025 20:23:58 +0800 Subject: [PATCH 1/2] Added OSV-Scalibr Test Image for winget extractor --- microsoft/winget/Dockerfile | 21 ++ microsoft/winget/README.md | 125 +++++++++ microsoft/winget/generate_testdata.py | 261 ++++++++++++++++++ .../AppRepository/StateRepository-Machine.srd | Bin 0 -> 81920 bytes .../installed.db | Bin 0 -> 81920 bytes .../LocalState/StoreEdgeFD/installed.db | Bin 0 -> 81920 bytes 6 files changed, 407 insertions(+) create mode 100644 microsoft/winget/Dockerfile create mode 100644 microsoft/winget/README.md create mode 100644 microsoft/winget/generate_testdata.py create mode 100644 microsoft/winget/testdata/ProgramData/Microsoft/Windows/AppRepository/StateRepository-Machine.srd create mode 100644 microsoft/winget/testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/Microsoft.Winget.Source_8wekyb3d8bbwe/installed.db create mode 100644 microsoft/winget/testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/StoreEdgeFD/installed.db diff --git a/microsoft/winget/Dockerfile b/microsoft/winget/Dockerfile new file mode 100644 index 00000000..06aefcc3 --- /dev/null +++ b/microsoft/winget/Dockerfile @@ -0,0 +1,21 @@ +FROM ubuntu:22.04 + +# Install bash and sqlite3 for database verification +RUN apt-get update && apt-get install -y bash sqlite3 && rm -rf /var/lib/apt/lists/* + +# Create Windows-style directory structure for WinGet databases +RUN mkdir -p /Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/Microsoft.Winget.Source_8wekyb3d8bbwe/ +RUN mkdir -p /Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/StoreEdgeFD/ +RUN mkdir -p /ProgramData/Microsoft/Windows/AppRepository/ + +# Create app directory for scalibr binary +RUN mkdir -p /app + +# Copy WinGet test database files into the container +COPY testdata/ / + +# Set working directory +WORKDIR /app + +# Default command: start bash so the container stays alive interactively +CMD ["/bin/bash"] diff --git a/microsoft/winget/README.md b/microsoft/winget/README.md new file mode 100644 index 00000000..4781c0ef --- /dev/null +++ b/microsoft/winget/README.md @@ -0,0 +1,125 @@ +# OSV-Scalibr: Windows Package Manager (WinGet) Extractor + +This directory contains the test Docker setup for testing OSV-Scalibr's WinGet extractor plugin. Windows Package Manager (WinGet) is Microsoft's official package manager for Windows systems that stores its database files in SQLite format at specific system locations. + +## Overview + +The WinGet extractor analyzes installed Windows packages by reading SQLite database files created by the Windows Package Manager. This testbed simulates the Windows file system structure and provides sample WinGet databases for testing purposes. + +## WinGet Database Locations + +The WinGet extractor looks for databases at these Windows paths: + +1. **User-installed packages**: `%LOCALAPPDATA%/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/Microsoft.Winget.Source_8wekyb3d8bbwe/installed.db` +2. **Store Edge packages**: `%LOCALAPPDATA%/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/StoreEdgeFD/installed.db` +3. **System-wide repository**: `%PROGRAMDATA%/Microsoft/Windows/AppRepository/StateRepository-Machine.srd` + +## Test Database Contents + +This testbed includes three sample databases with the following packages: + +### User Installed Database +- **Git.Git** v2.50.1 - Git version control system +- **Microsoft.VisualStudioCode** v1.103.1 - Visual Studio Code editor +- **Google.Chrome** v120.0.6099.109 - Google Chrome browser + +### Store Edge Database +- **Microsoft.PowerShell** v7.4.1 - PowerShell terminal +- **Mozilla.Firefox** v121.0.1 - Mozilla Firefox browser + +### System Repository Database +- **Microsoft.WindowsTerminal** v1.18.3181.0 - Windows Terminal +- **Microsoft.VCRedist.2015+.x64** v14.38.33135.0 - Visual C++ Redistributable + +## Setup Instructions + +### Build the Docker Image + +```bash +cd security-testbeds/microsoft/winget +docker build -t winget-test . +``` + +### Run the Container + +```bash +docker run -it --rm -v $(pwd):/app winget-test +``` + +This will: +- Start an interactive bash session +- Mount the current directory as `/app` inside the container +- Allow you to place the `scalibr` binary in `/app` and run tests + +### Running OSV-Scalibr + +1. Build or copy the `scalibr` binary to the current directory +2. Run the container as shown above +3. Inside the container, run scalibr with the WinGet extractor: + +```bash +# Extract from all WinGet databases +./scalibr --extractors=os/winget --result=winget_output.json + +# Or target specific paths +./scalibr --extractors=os/winget --result=winget_output.json --paths=/Users/test/AppData/Local,/ProgramData/Microsoft +``` + +### Verify Database Contents + +You can inspect the test databases using sqlite3: + +```bash +# Inside the container +sqlite3 /Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/Microsoft.Winget.Source_8wekyb3d8bbwe/installed.db + +# List tables +.tables + +# Query packages +SELECT i.id, n.name, v.version FROM manifest m +JOIN ids i ON m.id = i.rowid +JOIN names n ON m.name = n.rowid +JOIN versions v ON m.version = v.rowid; +``` + +## Regenerating Test Data + +The `generate_testdata.py` script can be used to recreate the test databases with different package sets: + +```bash +python3 generate_testdata.py +``` + +Edit the script to add new packages or modify existing ones before regenerating the databases. + +## Important Note: Windows-Only Extractor + +The WinGet extractor is designed to run **only on Windows systems** due to OS-specific requirements. When running in this Linux Docker container, you will see: + +```bash +./scalibr --plugins=os/winget --result=output.textproto +# Output: plugin os/winget can't be enabled: needs to run on a different OS than that of the scan environment +``` + +This is **expected behavior** and indicates the testbed is set up correctly. + +## Purpose of This Testbed + +This Docker setup serves several purposes: + +1. **Validation**: Provides a standardized environment to test WinGet database parsing logic +2. **Development**: Allows developers to work with realistic WinGet database structures without Windows +3. **CI/CD**: Can be used in automated testing pipelines to verify database schema compatibility +4. **Reference**: Documents the expected WinGet database structure and file locations + +## Expected Output (on Windows) + +When running scalibr successfully on a Windows system, you should see extracted package information for 7 total packages across the three databases, including package names, versions, and metadata like monikers, channels, tags, and commands. + +## Troubleshooting + +- **"needs to run on a different OS"**: This is expected when running on non-Windows systems +- **Database errors**: Verify the database files exist and have proper SQLite schema using the inspection commands above +- **Permission issues**: Make sure the scalibr binary has execute permissions: `chmod +x scalibr` +- **No packages found on Windows**: Ensure the WinGet extractor is enabled with `--plugins=os/winget` \ No newline at end of file diff --git a/microsoft/winget/generate_testdata.py b/microsoft/winget/generate_testdata.py new file mode 100644 index 00000000..d18c367b --- /dev/null +++ b/microsoft/winget/generate_testdata.py @@ -0,0 +1,261 @@ +#!/usr/bin/env python3 +""" +Generate sample WinGet SQLite databases for testing OSV-Scalibr WinGet extractor. + +This script creates SQLite databases with the same schema and sample data +used by the WinGet extractor tests. +""" + +import sqlite3 +import os +import sys + + +def create_winget_database(db_path, packages): + """Create a WinGet SQLite database with the given packages.""" + + # Remove existing database if it exists + if os.path.exists(db_path): + os.remove(db_path) + + # Ensure directory exists + os.makedirs(os.path.dirname(db_path), exist_ok=True) + + conn = sqlite3.connect(db_path) + cursor = conn.cursor() + + # Create schema (based on winget_test.go) + schema = """ + CREATE TABLE [metadata]( + [name] TEXT PRIMARY KEY NOT NULL, + [value] TEXT NOT NULL); + CREATE TABLE [ids](rowid INTEGER PRIMARY KEY, [id] TEXT NOT NULL); + CREATE UNIQUE INDEX [ids_pkindex] ON [ids]([id]); + CREATE TABLE [names](rowid INTEGER PRIMARY KEY, [name] TEXT NOT NULL); + CREATE UNIQUE INDEX [names_pkindex] ON [names]([name]); + CREATE TABLE [monikers](rowid INTEGER PRIMARY KEY, [moniker] TEXT NOT NULL); + CREATE UNIQUE INDEX [monikers_pkindex] ON [monikers]([moniker]); + CREATE TABLE [versions](rowid INTEGER PRIMARY KEY, [version] TEXT NOT NULL); + CREATE UNIQUE INDEX [versions_pkindex] ON [versions]([version]); + CREATE TABLE [channels](rowid INTEGER PRIMARY KEY, [channel] TEXT NOT NULL); + CREATE UNIQUE INDEX [channels_pkindex] ON [channels]([channel]); + CREATE TABLE [manifest](rowid INTEGER PRIMARY KEY, [id] INT64 NOT NULL, [name] INT64 NOT NULL, [moniker] INT64 NOT NULL, [version] INT64 NOT NULL, [channel] INT64 NOT NULL, [pathpart] INT64 NOT NULL, hash BLOB, arp_min_version INT64, arp_max_version INT64); + CREATE TABLE [tags](rowid INTEGER PRIMARY KEY, [tag] TEXT NOT NULL); + CREATE UNIQUE INDEX [tags_pkindex] ON [tags]([tag]); + CREATE TABLE [tags_map]([manifest] INT64 NOT NULL, [tag] INT64 NOT NULL, PRIMARY KEY([tag], [manifest])) WITHOUT ROWID; + CREATE TABLE [commands](rowid INTEGER PRIMARY KEY, [command] TEXT NOT NULL); + CREATE UNIQUE INDEX [commands_pkindex] ON [commands]([command]); + CREATE TABLE [commands_map]([manifest] INT64 NOT NULL, [command] INT64 NOT NULL, PRIMARY KEY([command], [manifest])) WITHOUT ROWID; + """ + + cursor.executescript(schema) + + # Keep track of existing lookup table entries to avoid duplicates + id_ids = {} + name_ids = {} + moniker_ids = {} + version_ids = {} + channel_ids = {} + tag_ids = {} + command_ids = {} + + next_id_id = 1 + next_name_id = 1 + next_moniker_id = 1 + next_version_id = 1 + next_channel_id = 1 + next_tag_id = 1 + next_command_id = 1 + + # Insert test data + for i, pkg in enumerate(packages, 1): + manifest_id = i + + # Insert or get IDs for lookup table values + if pkg["id"] not in id_ids: + id_ids[pkg["id"]] = next_id_id + cursor.execute( + "INSERT INTO ids (rowid, id) VALUES (?, ?)", (next_id_id, pkg["id"]) + ) + next_id_id += 1 + + if pkg["name"] not in name_ids: + name_ids[pkg["name"]] = next_name_id + cursor.execute( + "INSERT INTO names (rowid, name) VALUES (?, ?)", + (next_name_id, pkg["name"]), + ) + next_name_id += 1 + + if pkg["moniker"] not in moniker_ids: + moniker_ids[pkg["moniker"]] = next_moniker_id + cursor.execute( + "INSERT INTO monikers (rowid, moniker) VALUES (?, ?)", + (next_moniker_id, pkg["moniker"]), + ) + next_moniker_id += 1 + + if pkg["version"] not in version_ids: + version_ids[pkg["version"]] = next_version_id + cursor.execute( + "INSERT INTO versions (rowid, version) VALUES (?, ?)", + (next_version_id, pkg["version"]), + ) + next_version_id += 1 + + if pkg["channel"] not in channel_ids: + channel_ids[pkg["channel"]] = next_channel_id + cursor.execute( + "INSERT INTO channels (rowid, channel) VALUES (?, ?)", + (next_channel_id, pkg["channel"]), + ) + next_channel_id += 1 + + # Insert manifest using the lookup IDs + cursor.execute( + "INSERT INTO manifest (rowid, id, name, moniker, version, channel, pathpart) VALUES (?, ?, ?, ?, ?, ?, ?)", + ( + manifest_id, + id_ids[pkg["id"]], + name_ids[pkg["name"]], + moniker_ids[pkg["moniker"]], + version_ids[pkg["version"]], + channel_ids[pkg["channel"]], + -1, + ), + ) + + # Insert tags + for tag in pkg.get("tags", []): + if tag not in tag_ids: + tag_ids[tag] = next_tag_id + cursor.execute( + "INSERT INTO tags (rowid, tag) VALUES (?, ?)", (next_tag_id, tag) + ) + next_tag_id += 1 + cursor.execute( + "INSERT INTO tags_map (manifest, tag) VALUES (?, ?)", + (manifest_id, tag_ids[tag]), + ) + + # Insert commands + for command in pkg.get("commands", []): + if command not in command_ids: + command_ids[command] = next_command_id + cursor.execute( + "INSERT INTO commands (rowid, command) VALUES (?, ?)", + (next_command_id, command), + ) + next_command_id += 1 + cursor.execute( + "INSERT INTO commands_map (manifest, command) VALUES (?, ?)", + (manifest_id, command_ids[command]), + ) + + conn.commit() + conn.close() + print(f"Created database: {db_path}") + + +def main(): + base_dir = os.path.dirname(os.path.abspath(__file__)) + + # Sample packages for user installed database + user_packages = [ + { + "id": "Git.Git", + "name": "Git", + "version": "2.50.1", + "moniker": "git", + "channel": "", + "tags": ["git", "vcs", "developer-tools"], + "commands": ["git"], + }, + { + "id": "Microsoft.VisualStudioCode", + "name": "Microsoft Visual Studio Code", + "version": "1.103.1", + "moniker": "vscode", + "channel": "stable", + "tags": ["developer-tools", "editor", "ide"], + "commands": ["code"], + }, + { + "id": "Google.Chrome", + "name": "Google Chrome", + "version": "120.0.6099.109", + "moniker": "chrome", + "channel": "stable", + "tags": ["browser", "web"], + "commands": ["chrome"], + }, + ] + + # Sample packages for Store Edge database + store_packages = [ + { + "id": "Microsoft.PowerShell", + "name": "PowerShell", + "version": "7.4.1", + "moniker": "powershell", + "channel": "stable", + "tags": ["shell", "terminal", "microsoft"], + "commands": ["pwsh", "powershell"], + }, + { + "id": "Mozilla.Firefox", + "name": "Mozilla Firefox", + "version": "121.0.1", + "moniker": "firefox", + "channel": "release", + "tags": ["browser", "web", "mozilla"], + "commands": ["firefox"], + }, + ] + + # Sample packages for system repository + system_packages = [ + { + "id": "Microsoft.WindowsTerminal", + "name": "Windows Terminal", + "version": "1.18.3181.0", + "moniker": "wt", + "channel": "stable", + "tags": ["terminal", "microsoft", "system"], + "commands": ["wt"], + }, + { + "id": "Microsoft.VCRedist.2015+.x64", + "name": "Microsoft Visual C++ 2015-2022 Redistributable (x64)", + "version": "14.38.33135.0", + "moniker": "vcredist2022x64", + "channel": "", + "tags": ["runtime", "microsoft", "system"], + "commands": [], + }, + ] + + # Create databases + user_db_path = os.path.join( + base_dir, + "testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/Microsoft.Winget.Source_8wekyb3d8bbwe/installed.db", + ) + create_winget_database(user_db_path, user_packages) + + store_db_path = os.path.join( + base_dir, + "testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/StoreEdgeFD/installed.db", + ) + create_winget_database(store_db_path, store_packages) + + system_db_path = os.path.join( + base_dir, + "testdata/ProgramData/Microsoft/Windows/AppRepository/StateRepository-Machine.srd", + ) + create_winget_database(system_db_path, system_packages) + + print("All test databases created successfully!") + + +if __name__ == "__main__": + main() diff --git a/microsoft/winget/testdata/ProgramData/Microsoft/Windows/AppRepository/StateRepository-Machine.srd b/microsoft/winget/testdata/ProgramData/Microsoft/Windows/AppRepository/StateRepository-Machine.srd new file mode 100644 index 0000000000000000000000000000000000000000..26dbd9018050db41275e2cdbda23f554a97f678c GIT binary patch literal 81920 zcmeI*?Qh#e9Ki9joi=sT^qOW@tw~Da zuG<@=A|xdK5BLK>8n4+K-obm20D(4MuooN8AS5_HrEwdAc-K~6tF@i;<$S-7<4do1 zXWvw7=A`=R344fT}DO1bG2 zt(m#PnN!x>e8HMqoSi+<%DMZ<<%OA7&M#cIUd~@13(G62C$!4SX059;g%{@+3)aH? z)tMJc!|}|-h_;oe)Jo+$ts1P~iabsS6j6}=<}EI3szff?F5DVHRTf6WVg~o{;BSIr*iB! zJoRv!ik>P=?yjwJ{fD%hqnq-)?9CiMtTjDU@1y~lyFb(sw>_5+>!zrRs!cI_Z7`lW zd|2B`x1w~9%H7d*M|8`wqJVFYBt5`)l3vl_3n$zTMo$qYcRx*~wA=4S&90U^Bv3Do z30_UDc*4hK$9Te{(RjjCw~+{5oY~cQdpu!|aN8G+Crs`hPgwSjcnZC}nbC}P*K0c5 zd!`kO_aNRekVrni_3)BZ2=2C+eZ421$z-&xjCYfJ$GlZ=ynRHs)l3qz^+5I_I{1Q0*~ z0R#|00D*%l(C-FD|No#~UgAOk0R#|0009ILKmY**5J12aaL503`H7I`j5Ax*_tfRF)g{W_`uUy>@Y-T&gsk+{wwQ)8n~2XHGq>8RFb_ zhO6o$0rkyhq1;d(r?A)D@qb<37xKRRZf^!itq?!}0R#|0009ILKmY**5I{f(%gAfn z-TU4BfBk9WoVlH0NB`d+|Nl_PALNHrR>_Xw>qH4h-0Rucgxg6_W+9smDG$dBZs zy%HhyKmY**5I_I{1Q0*~0R#|000D8<*w`NM{~!H-J#9>wJNy6s`2PbT|Bw%`MF0T= z5I_I{1Q0*~0R#|00D*lhFs!BwjNe{vcz+qdogkp51N5lb0I5yK|NQ?$As@;=_i=<& z9RUOoKmY**5I_I{1Q0*~0R%+a7}s|6|MeatWo|nD`2SZzK9*krg#ZEwAb5u<^E#wpV^?r2J6HACsR6`ICGgzfe0Y2q1s}0tg_000IagfB*srAh5>;`eTN8sHKu!8TTCFTM>dpF!lTfq&N1Sq_TB+Go<;Qe*fP{8b`HO|6flSBW8R5zgK=E zH#ex6=2q1s}0tg_000IagfB*sqO`u183Lv%Vxby!t`KM4{EC?Wg00Iag zfB*srAb C>4IMX literal 0 HcmV?d00001 diff --git a/microsoft/winget/testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/Microsoft.Winget.Source_8wekyb3d8bbwe/installed.db b/microsoft/winget/testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/Microsoft.Winget.Source_8wekyb3d8bbwe/installed.db new file mode 100644 index 0000000000000000000000000000000000000000..02493632296d735b9c8866825fb3a772a5f84ccc GIT binary patch literal 81920 zcmeI*?Qh%09l&u?XG@lB`D`Ht)`p46&#XH3x7QZs}v#E=df0;Zec!ga4R^FYsHSv@x zMnV7q1Q0*~fl%P!w392HI%U5&+xM=v{hgrG@pc=%?T)vXoIY`3tGZIFy0w+_>s9wk za#8)v74??ZHNV%dyK5V@$G_%oY}VY3OY7@r2PN-c^3>MalPg=#y5Fuod&aD5)bIV6wH_@Sh*lVDGuqyc1XS(#G1wOI1~$C#shR zwdiffrR(nI#=Tq>LA<(pxjCCFEvl_Nl;SX3n;XthKhq6vwi-J6>S}e%O~jTYs8ug3 zm)NF!;LJpudLi6Y-@6{FoAGRVQzm<~wkq`*(z?Vbez(^Oc84t4X?nZ6etXE0J+I%~^SVQhp{Cbsy64w7 z&!2U@?%sB%wYwc}AUfRQZ14GWcDXT?I$)wL4-SF2CcWa&eQK5-I$+{;=mRDWq}-fL z9WZeT^Zu#yPB7V{cY;~>q5a(`B;$z*2Jx8r$)WL>rRjJ~u8Jp~R40IZG9FXHj0@>_ zO!nw_%(@T9Gm(rZ{xl8ZG4uJM@tCFQcucN7NyHz{ax<5V$CNPRiF7a?#l%%u*rfalQQA@m#4?vJXn(K^`s(2ibJZ<2Q{u z4~OeJROfGvWlIk^wmPQNcS=ir@5N_3H90=CzKJqXZB>SFGwEs4vlbql88eU(?MB_|){U*D9rr^dYK6`~LO?)p6zK71< zE4lBrZ>SSpdi!6^WJ?zoZ7US&eXp(B^xNKzeh|)Yn+;JD<@)P-r z{Ns_0kcuII00IagfB*srAbhj!H(MhLQh8R|M2?1YX3*q|6kM3|NAS? z|Krnw00IagfB*srAb}RUThDcdoL$bgrPT{hwS`Q;$`a z^XlgRg-0u2U#cue&;Nhjl7Car|NH1cijle^fB*srAb58d9jd>+W-3ce@5Q6bNn~Yox;tf0T6vvp zRqC#8|L5dS_3!`PmT$=4%3sT$t635P2q1s}0tg_000IagfB*sreBJ`toUojm{?$TO zJ=5=MH@MmJyV-G-*J}9rG4*UeztQRk-8uCXz=s?DzTXb^{O%+DAZYip>M?-M{!TBe zI{!QI@BiiGEld7FzA1mFegp6~@{XD%A%Fk^2q1s}0tg_000IagfWYT2kQ0ur+W$HI zOh429*LkY_Kdw9YNA3SHM?7pFYX1veOtt^b@Biuh|0m?{_5J_|NoN_D`61=2q1s}0tg_000IagfB*sr9Bl!8OF-2A7ZYOM*6sgf|9>HG>;C^A msSybQ1Q0*~0R#|0009ILKmY**j)8!_6F`J_1!Thh|NjT4Je@B9 literal 0 HcmV?d00001 diff --git a/microsoft/winget/testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/StoreEdgeFD/installed.db b/microsoft/winget/testdata/Users/test/AppData/Local/Packages/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe/LocalState/StoreEdgeFD/installed.db new file mode 100644 index 0000000000000000000000000000000000000000..83123f65ff71b99712579d8d42ddb9e4630d9670 GIT binary patch literal 81920 zcmeI*&2Q6Y9KdlqZj&Zy`T(J_5UOy65RG8ny1{lGFB$7rS|~w)SX7zTT_TdWO9BNB zlZqxy+W)cr3G6WL?6yhUZ4|hS*IkM<;4q0jetD9(&9W;&U#s=Y)OYbrDK*g{HJjBYzuTD+ue5C9 z2Thz1cSbfwz8^V}*~omG86W;}_;mVFdM#zA63JUhYv|U{DVdD{0R#|0009JifwleF zgt>2@esg=%zEp7*-D=gYEj1RZ_Dbjc&SUfWBZa(GIC69*Z(ZzMRh+meHz_YWjb_oB zo-KTM$eNuiShHtmW)8M;Ze4R~e){B*`3u(P`3nD<|ZH9vQ5 z`uNh0g!#^xzLqZ6mYi#?8mwH7EN8=to}HaOeKs%ab3A{(Rg1<#n7e4r&9+lz1mW(A zxzhH8IVMZl8{tr;?dZ->oT$62PO-G_dsN~+ol$W;pU98zvr%Q6xt(7l3 z^)73!I`u}`t#w(mSh8z1r_yE3irp-&*!3>wP|0qTtfMn?M-N(dePy9qt}TQG1gBe= zY+s8e=az;eCrnUs>l6rU(#Ui@rfTh`6DHh;cfy2$zdv#-nnmX(}3zO70zx+V|#ohC1U3|C(Cy zsO4nWc+}cxJSx?@NQ8f!xl*Dt9+g8)hobSQF~~(RxJKP zqH7?Le8JVjPm&>c(_-$6!Gvj=`kLvVn|^;0vD##oFV_M81nwL$ate|-iQGK1Q0*~0R#|0009ILKmY** z-d2H>7Z~mTxApK67Xk<%fB*srAb!>2<(U%+JTeqjdG=8PkvIaJIn4hQ#Z83C(DaDsZ_lF z|Csn)6OZMH0RaRMKmY**5I_I{1Q0*~0R;L+AZr}ZH?{v`rg1pgt^FVL|F3IeL#+2r zfK(I#1Q0*~0R#|0009ILKmY**+5(+-0$Aal02z5F!1(6=|9hIaC!V)AWDWrY5I_I{ z1Q0*~0R#|0009L0N1)?Q0M-7FWsLD;yZs;Z|NrUr|Nq%PaZytQ5I_I{1Q0*~0R#|0 z009IL*dmaUZv@!A9J~p@@Bd%%p8s#OpZ|ZTiHG$6Z*e050R#|0009ILKmY**5I_Kd zz7j|qyY;aB@Av<=+y6oT|5Hu85KsFmBr1yl0tg_000IagfB*srAbIlp#2~8 z|KHcdb8)}V0;0MIAbLP#u0tg_0 z00IagfB*srAb>#dfI!&(H%5$cz1{wgC5+KzyZyfr-2cA;8UhF)fB*srAb Date: Fri, 29 Aug 2025 21:28:05 +0800 Subject: [PATCH 2/2] Updated Readme with clear instructions on how to run winget extractor --- microsoft/winget/README.md | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/microsoft/winget/README.md b/microsoft/winget/README.md index 4781c0ef..90b3076b 100644 --- a/microsoft/winget/README.md +++ b/microsoft/winget/README.md @@ -51,18 +51,37 @@ This will: - Mount the current directory as `/app` inside the container - Allow you to place the `scalibr` binary in `/app` and run tests -### Running OSV-Scalibr +### Running OSV-Scalibr on Windows + +Since the WinGet extractor requires Windows OS, extract the test data from the container to run on a Windows system: + +1. Run the Docker container to extract test data: +```bash +docker run --rm -v $(pwd)/extracted_testdata:/output winget-test cp -r /Users /ProgramData /output/ +``` + +2. Copy the extracted test data to your Windows machine +3. On Windows, run scalibr with the `--root` flag pointing to the extracted directory: + +```bash +# Extract from all WinGet databases using extracted test data +scalibr.exe --extractors=os/winget --result=winget_output.json --root=C:\path\to\extracted_testdata + +# Or target specific paths within the extracted data +scalibr.exe --extractors=os/winget --result=winget_output.json --root=C:\path\to\extracted_testdata --paths=Users/test/AppData/Local,ProgramData/Microsoft +``` + +### Development/CI Testing (Linux) + +For development purposes, you can still use the Docker container to verify database contents, but note that the WinGet extractor will not run: 1. Build or copy the `scalibr` binary to the current directory 2. Run the container as shown above 3. Inside the container, run scalibr with the WinGet extractor: ```bash -# Extract from all WinGet databases +# This will show the expected "needs to run on a different OS" message ./scalibr --extractors=os/winget --result=winget_output.json - -# Or target specific paths -./scalibr --extractors=os/winget --result=winget_output.json --paths=/Users/test/AppData/Local,/ProgramData/Microsoft ``` ### Verify Database Contents