fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)

Co-authored-by: Tom Fay <[email protected]>

Author: aqua-bot

pkg/fanal/analyzer/pkg/rpm/rpmqa.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"os"
 	"slices"
+	"strconv"
 	"strings"
 
 	"golang.org/x/xerrors"
@@ -50,6 +51,7 @@ func (a rpmqaPkgAnalyzer) parseRpmqaManifest(r xio.ReadSeekerAt) ([]types.Packag
 	for scanner.Scan() {
 		line := scanner.Text()
 		var name, ver, rel, sourceRpm, arch string
+		var epoch int
 		// %{NAME}\t%{VERSION}-%{RELEASE}\t%{INSTALLTIME}\t%{BUILDTIME}\t%{VENDOR}\t(none)\t%{SIZE}\t%{ARCH}\t%{EPOCHNUM}\t%{SOURCERPM}
 		s := strings.Split(line, "\t")
 		if len(s) != 10 {
@@ -68,12 +70,18 @@ func (a rpmqaPkgAnalyzer) parseRpmqaManifest(r xio.ReadSeekerAt) ([]types.Packag
 		if err != nil {
 			return nil, xerrors.Errorf("failed to split source rpm: %w", err)
 		}
+		epoch, err = strconv.Atoi(s[8])
+		if err != nil {
+			return nil, xerrors.Errorf("failed to parse epoch number (%s): %w", s[8], err)
+		}
 		pkgs = append(pkgs, types.Package{
 			Name:       name,
 			Version:    ver,
+			Epoch:      epoch,
 			Release:    rel,
 			Arch:       arch,
 			SrcName:    srcName,
+			SrcEpoch:   epoch,
 			SrcVersion: srcVer,
 			SrcRelease: srcRel,
 		})

pkg/fanal/analyzer/pkg/rpm/rpmqa_test.go

@@ -21,7 +21,8 @@ func TestParseMarinerDistrolessManifest(t *testing.T) {
 			name: "happy path",
 			content: `mariner-release	2.0-12.cm2	1653816591	1653753130	Microsoft Corporation	(none)	580	noarch	0	mariner-release-2.0-12.cm2.src.rpm
 filesystem	1.1-9.cm2	1653816591	1653628924	Microsoft Corporation	(none)	7596	x86_64	0	filesystem-1.1-9.cm2.src.rpm
-glibc	2.35-2.cm2	1653816591	1653628955	Microsoft Corporation	(none)	10855265	x86_64	0	glibc-2.35-2.cm2.src.rpm`,
+glibc	2.35-2.cm2	1653816591	1653628955	Microsoft Corporation	(none)	10855265	x86_64	0	glibc-2.35-2.cm2.src.rpm
+ca-certificates-base	3.0.0-8.azl3	1748892790	1735838940	Microsoft Corporation	(none)	130628	noarch	1	ca-certificates-3.0.0-8.azl3.src.rpm`,
 			wantPkgs: []types.Package{
 				{
 					Name:       "mariner-release",
@@ -50,6 +51,17 @@ glibc	2.35-2.cm2	1653816591	1653628955	Microsoft Corporation	(none)	10855265	x86
 					SrcVersion: "2.35",
 					SrcRelease: "2.cm2",
 				},
+				{
+					Name:       "ca-certificates-base",
+					Version:    "3.0.0",
+					Epoch:      1,
+					Release:    "8.azl3",
+					Arch:       "noarch",
+					SrcName:    "ca-certificates",
+					SrcEpoch:   1,
+					SrcVersion: "3.0.0",
+					SrcRelease: "8.azl3",
+				},
 			},
 		},
 		{