Revert "SCA: Generate depends for shlibs ending in .so" and related commits (#2116)

* Revert "SCA: Skip binaries with invalid ELF sections"

This reverts commit ee43cbd.

* Revert "SCA: Improve vendored library handling"

This reverts commit 3796ede.

* Revert "SCA: Only process x86_64 and aarch64 binaries"

This reverts commit 786dcb2.

* Revert "SCA: Implement isIgnoredLibrary"

This reverts commit 6b376b7.

* Revert "SCA: Improve isHostProvidedLibrary"

This reverts commit 69aad51.

* Revert "SCA: Generate "depends" for shlibs ending in ".so" (#2072)"

This reverts commit 6b78277.

* Leave the schema for no-vendored-cross-package-deps

Signed-off-by: Łukasz 'sil2100' Zemczak <[email protected]>

---------

Signed-off-by: Łukasz 'sil2100' Zemczak <[email protected]>

Author: sil2100

.github/workflows/wolfi-presubmit.yaml

@@ -211,9 +211,6 @@ jobs:
             docker run --rm -v $(pwd):/work --workdir /work cgr.dev/chainguard/wolfi-base /bin/sh -c "sed 's|=.*||' -i /etc/apk/world; apk add --allow-untrusted -X ./packages/ packages/x86_64/${{ matrix.package }}-*.apk; ls -hal /usr/bin/sudo"
           elif [[ "${{ matrix.package }}" == "postfix" ]]; then
             docker run --rm -v $(pwd):/work --workdir /work cgr.dev/chainguard/wolfi-base /bin/sh -c "sed 's|=.*||' -i /etc/apk/world; apk add --allow-untrusted -X ./packages/ packages/x86_64/${{ matrix.package }}-*.apk; ls -hal /var/spool/postfix; ls -hal /var/lib/postfix"
-            # Test https://github.com/chainguard-dev/melange/pull/2072
-            PKGVER=$(tar -Oxf ./packages/x86_64/${{ matrix.package }}-stone-*.apk .PKGINFO | grep '^pkgver' | cut -d' ' -f3)
-            tar -Oxf ./packages/x86_64/${{ matrix.package }}-stone-*.apk .PKGINFO | grep "^depend = ${{ matrix.package }}=${PKGVER}"
           else
             docker run --rm -v $(pwd):/work --workdir /work cgr.dev/chainguard/wolfi-base /bin/sh -c "sed 's|=.*||' -i /etc/apk/world; apk add --allow-untrusted -X ./packages/ packages/x86_64/${{ matrix.package }}-*.apk"
           fi

docs/BUILD-FILE.md

@@ -218,16 +218,6 @@ options:
   no-versioned-shlib-deps: true
 ```
 
-`no-vendored-cross-package-deps` - When a subpackage `X` ships a
-vendored shared library that's used by subpackage `Y`, melange won't
-generate a `depends` from `Y -> X`.  By default, melange will generate
-a `depends` for `X=version`.
-
-```
-options:
-  no-vendored-cross-package-deps: true
-```
-
 ### scriptlets
 List of executable scripts that run at various stages of the package lifecycle,
 triggered by configurable events. These are useful to handle tasks that only

pkg/sca/e2e_test.go

@@ -73,7 +73,6 @@ func TestAnalyze(t *testing.T) {
 				"so:liblcms2-e69eef39.so.2.0.16",
 				"so:liblzma-13fa198c.so.5.4.5",
 				"so:libm.so.6",
-				"so:libopenblas64_p-r0-0cf96a72.3.23.dev.so",
 				"so:libopenjp2-eca49203.so.2.5.0",
 				"so:libpng16-78d422d5.so.16.40.0",
 				"so:libpthread.so.0",
@@ -150,17 +149,6 @@ func TestAnalyze(t *testing.T) {
 				"so:libm.so.6",
 				"so:libmount.so.1",
 				"so:libssl.so.3",
-				// libsystemd-core-256.so and
-				// libsystemd-shared-256.so are
-				// false-positives that get added to
-				// runtime deps because systemd links
-				// against these vendored libraries,
-				// but melange doesn't have enough
-				// context to determine that they are
-				// vendored because they're shipped by
-				// another subpackage.
-				"so:libsystemd-core-256.so",
-				"so:libsystemd-shared-256.so",
 				"so:libudev.so.1",
 			},
 			Provides: []string{