From 129f0f164d9677d4b47eafddc36438580c97c559 Mon Sep 17 00:00:00 2001
From: Yuvraj Saxena <ysaxenax@gmail.com>
Date: Sun, 31 Aug 2025 18:16:35 +0530
Subject: [PATCH] Add OVA Test Image for OSV-Scalibr

Related Issue: https://github.com/google/osv-scalibr/issues/1214

Related PR: https://github.com/google/osv-scalibr/pull/1243

Signed-off-by: Yuvraj Saxena <ysaxenax@gmail.com>
---
 ova/Alpine.ova | Bin 0 -> 78336 bytes
 ova/Dockerfile |  13 +++++++++++++
 ova/README.md  |  26 ++++++++++++++++++++++++++
 3 files changed, 39 insertions(+)
 create mode 100644 ova/Alpine.ova
 create mode 100644 ova/Dockerfile
 create mode 100644 ova/README.md

diff --git a/ova/Alpine.ova b/ova/Alpine.ova
new file mode 100644
index 0000000000000000000000000000000000000000..2b0ae6bf977983b41b579e8652ca37135570de9e
GIT binary patch
literal 78336
zcmeI2-*ekG635;4O*8!;Fw8^m9wh#dD9Ikltt>f>rdI5Wl3edzI+O_7obZQAQnGzF
zoyq;>cMB4bNJe&)G`(wjUp+_^fL$y;y8wYDN5RUE_{@*|&<R@c#yk4-AHy_^ZpSz>
z@=s6xTJqQI*`{@5+J@b+ZEDe>a+9vwN5-c&<z0>IG;<Q_a<ho<X!zzsor?OOHocbB
zG7__ASXTdCU7ume;M=<}U>lyKejE)ovt?-Co;C*O(S`@{iZeoTQmJLs{v>ds>!HS@
z=Bv3T3ZitV-DKJ7MAy^h4G*2P<%XHpij!-dH0WHa(@oj@gi1eDBym#rVVT<n5B1x0
z>4&<h(|5BlM7Q+uboSE=p2q8B$wxsDFP)6WI_FvDN7oZ4bCgY+^y52t?I+pV3Fh}{
z#=||j?^1tj`|a&*>$aW4u_)H{A7>ZyoLbY5C>o<B-&#aLR}tG3-B9tCZRjj-XbNkm
z4aNp9xW^Mt8dC9>3ZD8w;Y6R<dGv=oAbfh0aB{$?Jo}rjpS~e`TAR>)qv^Rmy{d39
zp(b;_6aZxh)5wcYFZ?uPvB$C-&ZLP<XiM2T<u3E1yk_Mr-#FKNpyx7$eL`Vw(9)r5
zKf51lmf7ib`t5F~UzjQsP04yPi>{>oVkl%=WlUb2gicoF72Y}tZ!P0c_oIv_o<nH#
zbj6px=NEyH>SDaDn=A~Tq*=n9@N$*;q5lu=YD~=fll5A_Gn}5yjbq-lI(*seIEL5k
zbFbfAm_5_(I?lo|+lrbPRSDDJInQq6q+CR<DaggwWJkcFqQ(1xNmV(s$O-vSdp>%Z
zJ3sgLgs02IrvZ?IE~>f<Uo7s)7k<i|)hh5sthEMuS*UP}F1sm$;9c_vm3YsM5sWJF
zB#kP@IoigBjMqvOT&{RRvog9?^Cyq6ty<Htb|cKOy`(^U<43Ltx_r_E0ma$%nu|D8
z%2=Au#&S=Dy*$`U3fSbQZf6eyYMDF#a{lsOu7e5xdF>}$Oe7~rX~tdn(fTeIFEy3(
zLf=0oSu629a}rksXem~5FXm&EZP<-$#AN>=kFu0euruc|s5F3rX3=G?SFCU+=K&Wg
zo>TCgsy>t<?5Pv_!Tmsgr)3@&J0(-OQcWkPhHPCbsx__z%haXLY4-8tv=S~-%R_A+
zQz<-jy4fy`O{-<?)0Q`rdIowG&R|OGc8Qd@*_@1>Vj@{v&f}|B=|Hbk?hMO|%i;BW
z9WHnxVpJN(O7i7~H63LS?d`kVpe9@Lf+;O671bK6+hR_pEt^*gYXZ_ce_1=^!|eW)
zIOn6TmrF64dL^uT8Sn1MuOdH7PiOqvIlIre!d$Pf8Khi9dq_4r6R1NT#tB96p-!6R
z?b)0bd?|FGXCCPCFyAO}2l|FqsC+yh;v2H>*L%lx6P~7Gj_3W4<o^e};JbVrM_Cfn
za-1j`<)WHQneudU&US(y=7zm}9_9oU@$YxSe7(r$$klZEW8D|3t~S1ktL#VocgQ4>
z*wu{w5H~29|E3#MpNF|Y0sU;;pd$M{Zb<2Dv5RUYbbue`qnD$Po)7zbJ<Jm-Ob_?O
z=-GH$i|s?^gQaLxW{I3ZA21=5n)i5Ooi3!22he{tKl^C-yN(V6-j!y(A9%j}SZc-k
zb=WSWE828M*{M<|@omd%OWA0h#dNarm%E$sX}$%P*6*vYsZiYM7#_KY`(iGdvoY;}
zrA+y*QR|{iyxdK>ye3k@-aFV6D!zG?#*zQC+3u<3PI*POsP(3*i`|x*Yn4(darg|_
zx~w)6w&gV&lppe=^x=LG2U<1_^V5625jfBf<!&DF!?QTe6o*rhp3sG$IGBqQzcjPb
zs5Y#UBm3`lqzr!L0QtA3QJIrF%T&=(DgDizwQpW!$y)7G_f^+Mq1?T6lQ>i$Rbj1d
z*`?!2^Tp+iO%i{jdMj7gB+H(y^i-~>$&@^He5l9Na&?Huly^VYV|$jok3)YhatxH-
zVUA13NpT#E*f*53`R4K2M;nJoCfca6YP&0};VhGWUytRsH8mx#m}*5SmDO4+wragQ
zr$oP!s@FXrT1>CHP+lq}%4^|3mj_Liuc#zWiiFLq$cN_1qk6`soai=>n}NvRXspQZ
z{d3{9J<qkeP0#JNo1L!JYc4#)Y}#(m?K@r1w)(waG*%?tDya*N6<MO8rZPerOCx8M
z-o)9{IB<C~)aLSks<FUHvw7xZe0)QBbjsjahGjR6ezR@7G>sFpcVgIo-zB`ndYC7K
z#&Ng`c*dE8a2DS&nN4HMIP(1KwaB7Td{M%+)TYRb4n!utP^8Ezilw}VJPp4X&BTFt
zsL>&^NNS4IkI0_+=_+vUMSt>`H`HFw=C8jWY3%h@%IsEzp883ihs|@!QqkG;a=z=A
zG*2%_SJN@$k+Yy&-cS>>t*k}lv%-ZRr>`g-d*NqUz|SL>Qkaj5h&6J~6W<9a8S_1V
zr13znnlzw&V8y`QR$eC8i;<9ByBZlCm$WO^SVn27p_X5lMxJAQN8-FBkzZFN2Kr8*
z)cHWK*r?LX6{|;b)k%YxQsahJqs3;UvE2PpZQn4gUhm9)YIK$Pear3`=d*1%O83#4
zRI^ZawCj9OP9jUO(c1N6WzsTs`I3^x6Z5!FhS8&f3HO|JKz8QNXRf&Y(A*ha%qhI8
zk)i%xu2u7rJ%e%JuNE<F8_R|BEKX<#vlpd^u6ng}CM72njQseov8y=A#<Vk~o~_(&
zu{D`qj%no~hZnY=#c?JgS^nQ)$^AddGSS$b@QuIZY~`eBc9X>G>l>9^meDhLJ<%8~
zBdcJ2eO>4)lFw{KM&u54a~<Nc+KHG`V#lV|x24s0+WlU?Y1)oQ4=~!@=E9;c>)5qD
zcVYJJuJKEC#*qrWYHGO)%AwYgRjS{ql|aSuRuL8F#|lt-zC(df0V)SvBg)7x#*CIy
zo}7p4AYb@|V{#^<ZXP%rUaKPQRAufJBUg&LePZnz+CdeH^p#jnX?=Y2sT_956Q@t-
zusz-^FEuY-j+uCN8eAr?UXF(veU)QnK$&g2Dabid2?KSP5qG5Xy9+0|=2sM!shYtm
z;!9JN;_hm6zH6}OUT_gd*E3o`9&Pla_4qx7*43+5%GiOfEG<gt5rTO7C-)PgY`gtX
z&khE<dQg7a_zWNZlgX8ROyvpiryEcH{zvzL_dhH{y!26j|D$J^^d88kGvQ%P|L5<2
z{4kll{)*^)aU{OK%Q?NxzeQQ``BMHKZ7+_F{w+UmRb7L9-B1Fm48Om70#BH@V=;BO
zj}!62NJG8xV>ZUq$*^~97~E_38ml~OD2hD!X)Ni5iHwW$+EA;%J<(`9Vdr-lB^sH#
zdo7{yVsiQX;%}^D9(USCht01>FXrd0`tCqwCDMc<@x)(bgP3?@hn+boXN@P5$yuY}
zx{KDPc=-G5udj<Ynb?qN9WAeNiVbjKB0VfBO0Rhw@+`S;E$`_RNGCLUgQ;V7&06gZ
zcU-EW^GvR5E0xmGJQgzDc2OhFkS%(LP8{b9!&w@~?xN}0oDPzvWi^jI$EB~Hx$HQW
zZFQt=xl}<_h!vlv_^Ex#Dx=g{7`xkdSUy;|=<{P$(Cakf4T7PjeWrK4-~F_Nfgk_^
zAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&
z00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY
z0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4ea
zAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&
z00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY
z0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4ea
zAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&00JNY0w4eaAOHd&
z00JQJKO^u(spl_C*SG`$5cuO0D9`_|{`kYi2x|m>n9N=azkhKgzQ4<B-{#+<toUs2
z3)_pMqkqY|xAOO>!M<)N0ab=y5CDPSHGxsE@*_U;BR_P4R_Of}#u}z!bUVh8k$-yf
z*OI@6VOi#pX&ZLOwy8yj%1yg%Q2XD)n7Yn&nmGw|xmm<_@y0VB>QvPKwCT01mXVk}
zvbkT^^jZF&KO33sPt_<O41Z=rX4sy!>>hjlPM<Hh(e;*&X_;NO=Qs=Q*~i`GqQlL;
z*Vv<@>H6s#@?&cgx^ILsv+Z?E_t^FLV!3E@ZXcVDZ92!?HWs#J_l!li)9ZB2#%D?K
H^ELWEtQ87Z

literal 0
HcmV?d00001

diff --git a/ova/Dockerfile b/ova/Dockerfile
new file mode 100644
index 00000000..1f6a8e8b
--- /dev/null
+++ b/ova/Dockerfile
@@ -0,0 +1,13 @@
+FROM ubuntu:22.04
+
+RUN apt-get update
+
+RUN mkdir -p /testdata
+
+# Set working directory
+WORKDIR /testdata
+
+# Copy valid-but-nonbootable .ova file into the container
+COPY Alpine.ova /testdata/Alpine.ova
+
+CMD ["/bin/bash"]
\ No newline at end of file
diff --git a/ova/README.md b/ova/README.md
new file mode 100644
index 00000000..1abdca63
--- /dev/null
+++ b/ova/README.md
@@ -0,0 +1,26 @@
+# OSV-Scalibr: OVA Extractor
+
+This directory contains the test Dockerfile for testing OSV-Scalibr's ova Extractor plugin. Open Virtualization Appliance (OVA) package is a tar archive file with the OVF directory inside. Open Virtualization Format (OVF) is an open standard for packaging and distributing virtual appliances.
+
+## Setup
+
+### Build the Docker Image
+
+```bash
+cd security-testbeds/ova
+docker build -t ova-extractor-testbed .
+```
+
+### Run the Container
+
+```bash
+docker run -it --rm ova-extractor-testbed /bin/bash
+```
+
+### Running OSV-Scalibr
+
+Build or copy the `scalibr` binary to the current directory, and inside the container, run `scalibr` with the ova extractor:
+
+```bash
+./scalibr --extractors=embeddedfs/ova --result=output.textproto .
+```
\ No newline at end of file