This repository was archived by the owner on Jan 27, 2023. It is now read-only.
Filter packages that are "owned" by other packages #917
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15d8c71 to
93c0989
Compare
alfredodeza
reviewed
Feb 22, 2021
c4e92e2 to
a39b96b
Compare
9048d74 to
03b7581
Compare
c74ad9a to
03b7581
Compare
|
I resolved the conflict on the Dockerfile, and that should also merge in the jsonschema fix causing the CI failure |
1ec0e46 to
c29a367
Compare
alfredodeza
approved these changes
Mar 2, 2021
Signed-off-by: Alex Goodman <[email protected]>
c29a367 to
90ca9bb
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Today engine will perform vulnerability matching for all packages discovered within a image, even if a given package is really "owned" by a parent package (e.g. An RPM has packaged within it a Python wheel that gets installed, the RPM is the "owner" of the wheel package). In these cases the parent package should be used for vulnerability matching and the child should be ignored (see #315 , #445 , and #460).
This PR bumps the syft version that labels relations between packages + adds a filter to the SBOM report to exclude packages that are owned by other packages.
Additionally this PR allows for additional attributes on image import, enabling schema additions to not cause a 400 to be returned.
Which issue this PR fixes
Fixes #445 , Fixes #460
Tasks:
anchore-cli image add ...)