Alpine OS analyzer duplicate in release.go

[amitverse]

Question

Since we already have Alpine OS analyzer here https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/analyzer/os/alpine/alpine.go, still we are encountering Alpine OS analyzer at https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/analyzer/os/release/release.go.

I debugged the code. We are doing the same task using both the analyzer. I think we should remove Alpine OS analyzer from release.go.

I want to discuss it with community before raising the issue as a bug/feature. Please share your opinion on it. I would be happy if anyone prove me wrong.

Thanks

Target

None

Scanner

None

Output Format

None

Mode

None

Operating System

No response

Version

No response

[DmitriyLewen]

hm... This is interesting.
I checked a few alpine images (2.6, 3.2, 3.10, 3.21).
2.6 image contains only alpine-release file.
3.x images contain both os-release and alpine-release files.

So it looks like we can check only alpine-release file.
@knqyf263 Do you remember why you added 2 analyzers?

[knqyf263]

Distroless images didn't have alpine-release at that time.
aquasecurity/fanal#468

Also, as you investigated, some images have only alpine-release. It's better to analyze both files.

[DmitriyLewen]

Oh, I forgot to check distroless images.
Thanks for the clarification!