implement v5 db schema to support improved matching between rpm appstream modules #944
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
westonsteimel
force-pushed
the
grype-db-package-qualifier
branch
3 times, most recently
from
fa6655d to
072ed00
Compare
westonsteimel
force-pushed
the
grype-db-package-qualifier
branch
10 times, most recently
from
957bf64 to
8a2ccd5
Compare
westonsteimel
changed the title
westonsteimel
changed the title
westonsteimel
force-pushed
the
grype-db-package-qualifier
branch
from
c87ff33 to
fd882ee
Compare
wagoodman
reviewed
Oct 17, 2022
wagoodman
reviewed
Oct 17, 2022
wagoodman
reviewed
Oct 17, 2022
wagoodman
reviewed
Oct 17, 2022
wagoodman
reviewed
Oct 17, 2022
wagoodman
reviewed
Oct 17, 2022
wagoodman
reviewed
Oct 17, 2022
| @@ -18,8 +18,8 @@ import ( | |||
| var update = flag.Bool("update", false, "update the *.golden files for diff presenter") | |||
|
|
|||
| const ( | |||
| baseURL = "https://toolbox-data.anchore.io/grype/databases/vulnerability-db_v4_2022-07-05T08:18:22Z_39868af44fc51829a7c9.tar.gz" | |||
| targetURL = "https://toolbox-data.anchore.io/grype/databases/vulnerability-db_v4_2022-07-06T08:16:42Z_c840f17244dea46d0c07.tar.gz" | |||
| baseURL = "https://toolbox-data.anchore.io/grype/staging-databases/vulnerability-db_v5_2022-10-14T08:22:01Z_69c99aa5917dea969f2d.tar.gz" | |||
There was a problem hiding this comment.
not in scope for this PR: we need to rework this test to not be dependent on hosted DBs like this. We're thinking about deprecating beyond a time window in the future, which means this test would start to fail after 90days (or whatever window we go with).
We could capture this as an OCI artifact, but there is also the problem that this is coupled to the current DB schema version... should we change this? or is this assumption OK? In which case, we just need a nice way to continually update the fixture when we bump the schema version.
There was a problem hiding this comment.
I have gone ahead and disabled this now as it started failing again when I updated everything else to use the non staging endpoint
westonsteimel
force-pushed
the
grype-db-package-qualifier
branch
from
9c58492 to
5f7d22a
Compare
wagoodman
approved these changes
Oct 17, 2022
wagoodman
approved these changes
Oct 17, 2022
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
…nerability matches Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
…e version flip Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
…qualifier Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
westonsteimel
force-pushed
the
grype-db-package-qualifier
branch
from
77f7694 to
40ea037
Compare
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds support for a
package_qualifierscolumn to allow evaluating package matches to vulnerabilities based on more than just version constraints. Currently adds anrpm-modularityqualifier in order to support matching to correct app stream module in order to reduce false positives within rpm-based distro ecosystems. In order to prevent an increase in false positive matches for previous versions of grype using the v4 schema, this change (along with the vulnerability source driver parser updates) requires bumping the schema to v5.