UBI-based images do not generate any vulnerabilities

[jeason81]

What happened:
When scanning a UBI-based image such as registry.access.redhat.com/ubi8/ubi:latest, the utility identifies 191 packages installed but 0 vulnerabilities.

What you expected to happen:
I expected that UBI would match the RedHat vulnerability information just as it does with CentOS images.

How to reproduce it (as minimally and precisely as possible):
grype registry.access.redhat.com/ubi8/ubi:latest
grype centos:latest

Anything else we need to know?:
RedHat UBI image uses the same packages as RedHat Enterprise Linux and thus CentOS. Likely the utility itself isn't aware of the similarity.

Environment:

• Output of grype version:

Application:          grype
Version:              0.6.0
BuildDate:            2020-12-03T22:35:30Z
GitCommit:            1a75295d702a5f80d02d45a6263f96925673c775
GitTreeState:         clean
Platform:             darwin/amd64
GoVersion:            go1.14.12
Compiler:             gc
Supported DB Schema:  1

• OS (e.g: cat /etc/os-release or similar): MacOS 11 Big Sur

[wagoodman]

@jeason81 good catch. @luhring discovered that in some cases we are using both the major and minor distro version fo selecting the vulnerability source, where in some cases we should be using only the major version. In this case we were using a namespace of rhel:8.3 where it should have been rhel:8.

[wagoodman]

@jeason81 v0.6.1 was just released with this fix. Thanks for reporting!