fix: migrate from *.list to *.md5sums files for dpkg

[DmitriyLewen]

Description

We currently use *.list files to detect files of dpkg packages.
But distroless images don't have this file (See #9046).

So we migrate from to **/info/*.md5sums (**/status.d/*.md5sums for distroless) files.

Example

before:

➜  trivy -q image -f json --list-all-pkgs --cache-backend memory gcr.io/distroless/nodejs20-debian12 | jq '.Results[].Packages[] | select(.Name=="base-files") | .InstalledFiles' 

null

after:

➜  ./trivy -q image -f json --list-all-pkgs --cache-backend memory gcr.io/distroless/nodejs20-debian12 | jq '.Results[].Packages[] | select(.Name=="base-files") | .InstalledFiles'

[
  "/usr/lib/os-release",
  "/usr/share/base-files/dot.bashrc",
  "/usr/share/base-files/dot.profile",
...
  "/usr/share/doc/base-files/README",
  "/usr/share/doc/base-files/README.FHS",
  "/usr/share/doc/base-files/changelog.gz",
  "/usr/share/doc/base-files/copyright",
  "/usr/share/lintian/overrides/base-files"
]

Related issues

• Close feat(dpkg): check /var/lib/dpkg/*/<package>.md5sums to find list of system files #9046

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I investigated this case:
list file contains 2 files:

➜  docker run -it --rm --platform=linux/amd64 debian:12 cat var/lib/dpkg/info/libidn2-0\:amd64.list | grep libidn2.so.0
/usr/lib/x86_64-linux-gnu/libidn2.so.0.3.8
/usr/lib/x86_64-linux-gnu/libidn2.so.0

But md5sums file contains only one file:

➜  docker run -it --rm --platform=linux/amd64 debian:12 cat var/lib/dpkg/info/libidn2-0\:amd64.md5sums | grep libidn2.so.0
c745ba8b8dfd28a2aa7efb3081ca5eed  usr/lib/x86_64-linux-gnu/libidn2.so.0.3.8

libidn2.so.0 is link to libidn2.so.0.3.8 file:

➜  docker run -it --rm --platform=linux/amd64 debian:12 ls -hl /usr/lib/x86_64-linux-gnu | grep libidn2.so.0
lrwxrwxrwx  1 root root   16 Aug 28  2022 libidn2.so.0 -> libidn2.so.0.3.8
-rw-r--r--  1 root root 195K Aug 28  2022 libidn2.so.0.3.8

That is why md5sums doesn't have this file.

---

Trivy doesn't currently support links - #5356
So this shouldn't be a problem.

[knqyf263]

Can you write a comment to the source code somewhere so that we can recall it when we add support for symlinks?

[DmitriyLewen]

added in 97a8340

[Copilot]

Pull Request Overview

This PR refactors the dpkg analyzer to read *.md5sums files instead of legacy *.list files, improving compatibility with distroless images.

• Replace .list parsing logic with .md5sums parsing in code and tests
• Update Required and isMd5SumsFile to detect only .md5sums files
• Refresh testdata and golden outputs to use tar.md5sums and new UIDs

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/fanal/analyzer/pkg/dpkg/dpkg.go	Switch parsing from .list to .md5sums, implement parseDpkgMd5sums, update file-detection logic
pkg/fanal/analyzer/pkg/dpkg/dpkg_test.go	Adapt tests to .md5sums files, update expected installed files and test cases
pkg/fanal/analyzer/pkg/dpkg/testdata/tar.md5sums	Add new md5sums-format testdata
pkg/fanal/analyzer/pkg/dpkg/testdata/tar.list	Remove obsolete .list testdata
integration/testdata/debian-buster-ignore-unfixed.json.golden	Update golden UID for package identifiers

Comments suppressed due to low confidence (2)

pkg/fanal/analyzer/pkg/dpkg/dpkg.go:127

• [nitpick] Consider renaming the variable file to something like filePath for clarity, since it represents the extracted file path from the md5sums line.

		_, file, ok := strings.Cut(current, "  ")

pkg/fanal/analyzer/pkg/dpkg/dpkg.go:119

• Add unit tests for malformed md5sums lines (e.g. missing delimiter) to verify that the parser returns the expected error.

func (a dpkgAnalyzer) parseDpkgMd5sums(scanner *bufio.Scanner) ([]string, error) {

[knqyf263]

nit: I was concerned that there might be cases where there are three spaces instead of two, or where tabs are used, so I thought it might be better to implement it in a way that wouldn’t be affected by such differences. However, if it’s guaranteed that it will always be two spaces, I think the current implementation is fine.

Suggested change

	_, file, ok := strings.Cut(current, " ")
	if !ok {
	return nil, xerrors.Errorf("invalid md5sums line format: %s", current)
	}
	ss := strings.Fields(current)
	if len(ss) != 2 {
	return nil, xerrors.Errorf("invalid md5sums line format: %s", current)
	}

[DmitriyLewen]

even old versions (I checked it in Ubuntu 12.04) use this format
also the documentation clearly states about 2 spaces - https://man7.org/linux/man-pages/man5/deb-md5sums.5.html
so I think we can leave it like this and fix it if there is feedback from users (analyze their case first)

[knqyf263]

I thought it might be safer to make the change, as it would handle more cases unless the current code has a clear advantage in terms of readability or lines of code. But we can leave it as I don't stick to that.

[knqyf263]

Can you write a comment to the source code somewhere so that we can recall it when we add support for symlinks?

[knqyf263]

Since this affects Trivy's output (especially Distroless), it's not refactoring. The prefix should be feat or fix.

[DmitriyLewen]

yes. Thanks. Updated
I always hesitate things like this:
this is a fix for distroless, but the changes (and the PR name) are not directly related to this fix.