Excluding a directory does not work on Windows

[UnitedHaxor]

When I use syft with option packages, the --exclude argument seems to be ignored.
The output tells me that there is a problem to access a zip file in %APPDATA%/Local/Temp/2/syft-archive-contents-... (not a valid zip file) or (the process cannot access the file because it is being used by another process).
So it seems that syft is analyzing its own temporal archive.

[0012] WARN cataloger 'java-cataloger' failed to parse entries at location=Location<id=3767 RealPath="C:\Users\asd\AppData\Local\Temp\2\syft-archive-contents-2361904858\archive-archive-archive-archive-archive-arch
ive-archive-archive-archive-archive-archive-python-3.8.zip">: unable to read files from java archive: unable to open zip archive (C:\Users\asd\AppData\Local\Temp\2\syft-archive-contents-2300921872\archive-archive-archive-a
rchive-archive-archive-archive-archive-archive-archive-archive-archive-python-3.8.zip): cannot find beginning of zip archive="C:\Users\asd\AppData\Local\Temp\2\syft-archive-contents-2300921872\archive-archive-archi
ve-archive-archive-archive-archive-archive-archive-archive-archive-archive-python-3.8.zip" : zip: not a valid zip file
[0012] ERROR unable to cleanup archive tempdir: remove C:\Users\asd\AppData\Local\Temp\2\syft-archive-contents-3815765297\archive-archive-archive-archive-archive-archive-archive-archive-archive-archive-archive-python-3.8.z
ip: The process cannot access the file because it is being used by another process.

Hence I tried to add the Temp directory to the exclusion list, but no success.

from powershell
cd /
.\syft\syft.exe packages --exclude '**/Temp' dir:c:\

Also when I try '**/* everything will be checked, too.

BTW: When I try to specify an absolute directory, it tells me that I need to use one of ./, / or **/. But I just want to use c:\ or /c/Users//AppData/Local/Temp or similar.

Second question:
It seems that the output does not contain any exe file or program-name of an installed application. Is this correct? It only finds some python files at c:\cygwin64 for example.

Thank you very much for your help.

Environment:

Application: syft
Version: 0.46.3
JsonSchemaVersion: 3.2.3
BuildDate: 2022-05-26T06:46:34Z
GitCommit: 7cb8e1f
GitDescription: v0.46.3
Platform: windows/amd64
GoVersion: go1.18.2
Compiler: gc

Windows Server 2019 Datacenter Evaluation

[UnitedHaxor]

Hi, still no answer? :(

[spiffcs]

Hi @UnitedHaxor!

Sorry for missing this and thank you for bumping this to the top of our queue. Let me read through this and get a good answer put together for you. Also thank you for the detail here. I don't have a windows environment at the moment that can replicate this but can work on getting it reproduced on my local.

[nba1992]

I'm currently stucked at the exact same stage.. Waiting for the answer! ;)
Application: grype
Version: 0.41.0
Syft Version: v0.50.0
BuildDate: 2022-07-06T15:20:18Z
GitCommit: 0e0a9d9e7a28592db489499db0294608e5fe69b8
GitDescription: v0.41.0
Platform: windows/amd64
GoVersion: go1.18.3
Compiler: gc
Supported DB Schema: 4

[gruselglatz]

I see the same behavior. I cant get syft to exclude a dir under windows.
Tried every possible combination and even excluding everything, like @UnitedHaxor mentioned.

[dengel-rnd]

This issue is marked as closed, but I am having the OP's exact trouble using version 0.95.0 of Syft. Was there a change that broke the fix?

[spiffcs]

Thanks for the reported resurface @dengel-rnd - I've reopened the issue pending reproduction on our end

[dengel-rnd]

Thanks for the reported resurface @dengel-rnd - I've reopened the issue pending reproduction on our end

OK, I figured out what is going on. Maybe this needs just some documentation clarity or it could be improved as a robustness issue:

When I was running syft, I would do something like

syft.exe dir:c:\...

When syft performed its exclusion check against the tree, it was internally receiving (from the OS) paths like 'C:\...' - note the change in case for the drive letter. Apparently, this is what was preventing the exclusion matches.

(Yuck - time for Windows to just abandon drive letters altogether?)