Method parseDpkgMd5sums

pkg/fanal/analyzer/pkg/dpkg/dpkg.go:191–212

parseDpkgMd5sums parses `/var/lib/dpkg/*/*.md5sums` file. `*.md5sums` files don't contain links (see https://github.com/aquasecurity/trivy/pull/9131#discussion_r2182557288). But Trivy doesn't support links, so this will not cause problems. TODO use `*.list` files instead of `*.md5sums` files when T

(scanner *bufio.Scanner)

// But Trivy doesn't support links, so this will not cause problems.
// TODO use `*.list` files instead of `*.md5sums` files when Trivy will support links.
func (a dpkgAnalyzer) parseDpkgMd5sums(scanner *bufio.Scanner) ([]string, error) {
	var installedFiles []string
	for scanner.Scan() {
		current := scanner.Text()

		// md5sums file use the following format:
		// <digest>  <filepath> (2 spaces)
		// cf. https://man7.org/linux/man-pages/man5/deb-md5sums.5.html
		_, file, ok := strings.Cut(current, "  ")
		if !ok {
			return nil, xerrors.Errorf("invalid md5sums line format: %s", current)
		}
		installedFiles = append(installedFiles, "/"+file) // md5sums files don't contain leading slash
	}

	if err := scanner.Err(); err != nil {
		return nil, xerrors.Errorf("scan error: %w", err)
	}

	sort.Strings(installedFiles)
	return installedFiles, nil
}

// parseDpkgAvailable parses /var/lib/dpkg/available
func (a dpkgAnalyzer) parseDpkgAvailable(fsys fs.FS) (map[string]digest.Digest, error) {