secscan: implement basescore/cveid (PROJQUAY-6697) #2684
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
arborite-rh
force-pushed
the
rb/basescore-cveid
branch
from
262b51b
to
e51856b
Compare
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## master #2684 +/- ##
=======================================
Coverage 70.70% 70.71%
=======================================
Files 435 436 +1
Lines 40181 40234 +53
Branches 5225 5237 +12
=======================================
+ Hits 28411 28451 +40
- Misses 10117 10126 +9
- Partials 1653 1657 +4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Signed-off-by: Ross Bryan <robryan@redhat.com>
arborite-rh
force-pushed
the
rb/basescore-cveid
branch
from
e51856b
to
cb0c955
Compare
Signed-off-by: Ross Bryan <robryan@redhat.com>
Signed-off-by: Ross Bryan <robryan@redhat.com>
Signed-off-by: Ross Bryan <robryan@redhat.com>
arborite-rh
force-pushed
the
rb/basescore-cveid
branch
from
3c164e3
to
9e8edef
Compare
dmage
approved these changes
Mar 20, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This implements FEDRAMP requirements of providing BaseScores and CVE IDs for a given version of software/vulnerabilities associated with it.
The goal is for this to be a temporary stop-gap solution until these values are available through the Clair API and eventually ACS services.
The design of this PR currently utilizes the existing endpoint and builds the two new fields into the
Featuresobject. This shouldn't have any adverse effect on clients. I've manually tested the UI and everything still looks good/loads as expected.The majority of the changes in this PR come from updating the JSON files for unit-testing, and lots of new line from
make blacklinting.Example screenshot of the new JSON response for this endpoint:
