Conversation
Signed-off-by: Ildar Mulyukov <ildar.mulyukov@bell-sw.com>
* Alpaquita * BellSoft Hardened Containers Signed-off-by: Ildar Mulyukov <ildar.mulyukov@bell-sw.com>
|
@willmurphyscode , plz check |
|
|
||
| func AndConstraints(c ...string) string { | ||
| return strings.Join(c, " ") | ||
| return strings.Join(c, ", ") |
There was a problem hiding this comment.
I'm not certain I understand this change, which is the reason why tests are failing
There was a problem hiding this comment.
--- FAIL: TestTransform (0.00s)
transform_test.go:302: data entries mismatch (-want +got):
[]transformers.RelatedEntries{
{
VulnerabilityHandle: &{Name: "BIT-apache-2020-11984", Status: "active", PublishedDate: &s"2024-03-06 10:57:57.77 +0000 UTC", ModifiedDate: &s"2025-01-17 15:26:01.971 +0000 UTC", ...},
Provider: nil,
Related: []any{
v6.AffectedPackageHandle{
... // 6 identical fields
Package: &{Ecosystem: "Bitnami", Name: "apache"},
BlobID: 0,
BlobValue: &v6.PackageBlob{
CVEs: {"CVE-2020-11984"},
Qualifiers: nil,
Ranges: []v6.Range{
{
Version: v6.Version{
Type: "bitnami",
- Constraint: ">=2.4.32,<=2.4.43",
+ Constraint: ">=2.4.32,,<=2.4.43",
},
Fix: nil,
},
},
},
},
},
},
}
There was a problem hiding this comment.
@wagoodman , thanks for looking into this.
- the reason is here: providers: add BellSoft OSV provider vunnel#924 (comment)
- the test is easy to fix, I'll push the fix soon. But before that I wanted @willmurphyscode to take a look.
|
just a heads up -- we've ported much of the lib code to grype. This PR was a little up in the air, so I did not port it over. Sorry for any hassle! |
|
Hi @i-bs we are moving this transformer logic into grype and will end up changing some other things as well. In particular, there are several in flight vunnel providers (yours, CRAN, openEuler, probably others) that all put pressure on this transformer. I think rather than asking each contributor to make separate competing fixes to the OSV transformer, I'm going to take some time to make sure it correctly processes OSV output from these upcoming vulnerability providers. Please be patient with me! This takes some coordination between different repos and PRs. Given that, I think it makes sense to close this PR, and I'll let you know if I need any changes on anchore/vunnel#924 Thanks! |
3 participants
fix: conjunction-ed constraints must be comma-delimetered
Note: in couple with anchore/vunnel#924