Skip to content

Fix panic on cabal.project.freeze installed constraints dropping all Haskell packages#5040

Open
Synvoya wants to merge 1 commit into
anchore:mainfrom
Synvoya:fix/haskell-cabal-freeze-installed-panic
Open

Fix panic on cabal.project.freeze installed constraints dropping all Haskell packages#5040
Synvoya wants to merge 1 commit into
anchore:mainfrom
Synvoya:fix/haskell-cabal-freeze-installed-panic

Conversation

@Synvoya

@Synvoya Synvoya commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Description

syft panics on real cabal.project.freeze files and drops all Haskell packages from the scan.

Every cabal freeze emits any.<pkg> installed, constraints for GHC boot libraries (base, array, ghc-prim, ...). parseCabalFreeze splits each constraint on " ==" and unconditionally reads fields[1]; an installed line has no " ==", so fields has length 1 and fields[1] panics with index out of range [1]. The per-cataloger recover then swallows the panic and yields zero Haskell packages for the entire scan.

Reproducible on any real freeze file (e.g. cabal init -n && cabal freeze), which is the same repro from the previously-closed #1362 — that fix guarded a different index and the panic simply moved to fields[1].

Fix

Skip constraint lines without a version (len(fields) < 2) so installed boot-lib lines are ignored and the remaining == version packages parse normally.

Test

Extended testdata/cabal.project.freeze with any.array installed, / any.base installed,. The existing exact-set assertion in parse_cabal_freeze_test.go is now a regression guard: it passes only if the installed lines are skipped and every real package still parses. Before the fix the fixture panicked.

GHC boot-lib constraints (any.base installed) have no ' ==', so fields[1] panicked with index out of range and the recover dropped all Haskell packages. Skip constraint lines without a version.

Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com>
@wagoodman wagoodman added the bug Something isn't working label Jul 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Haskell Cabal packages crash syft

2 participants