fix: use fix info from secDB in APK matcher even if NVD fix info present #2162
Conversation
Signed-off-by: Will Murphy <[email protected]>
This enables the vunnel / grype-db to pull fix info from NVD end-of-version-range data in general without introducing spurious fixes into sec db. (If Alpine has fixed something, it will be in sec db, so we should ignore grype-db's attempt to infer fix info from NVD data specifically in the APK cataloger.) Signed-off-by: Will Murphy <[email protected]>
Signed-off-by: Will Murphy <[email protected]>
willmurphyscode
force-pushed
the
fix-alpine-fixed-state-only-from-secdb
branch
from
2a52b37
to
63cab3e
Compare
Signed-off-by: Will Murphy <[email protected]>
willmurphyscode
changed the title
|
I hesitated over the |
|
This is the correct fix info to surface for secdb. @willmurphyscode I noticed that your PR also mentioned chainguard and wolfi. I have not looked at those vuln providers in a while, but it seems these changes are only for the APK matcher. Are there more changes you're looking to make? This does look 🟢 from the correctness of secdb fixed in is being respected over nvd for the APK matcher and the tests prove it. |
|
@spiffcs thanks for the question. Chainguard and Wolfi images also use APK packages, so this code change will affect them as well. They also use secDB fixes, but with different URLs (the vunnel providers are very similar). As far as I can tell, this change covers Chainguard and Wolfi images as well. |
This is to address false fixed ins in Alpine, Chainguard, or Wolfi that might be introduced by anchore/grype-db#112.
TODO