Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Packages installed from Package manager may from different namespace #668

Closed
KeyboardNerd opened this issue Dec 10, 2018 · 2 comments
Closed
Assignees
Labels
priority/high important functionality
Milestone

Comments

@KeyboardNerd
Copy link
Contributor

Description of Problem / Feature Request

First: This may not be an issue.

Motivation:
On CentOS, yum may download from RHEL RPM repository and install RHEL binary.
In this case, the binary is compiled for RHEL but compatible with CentOS.
Since it's a binary and compiled for RHEL, which may have compiler flag difference, there might be difference in the set of vulnerabilities. Moreover, the namespaces for RHEL vulnerabilities and CentOS vulnerabilities are different.

We should modify our core Clair logic to understand that a package may have absolute indication of the namespace, which may not detected by the namespace detectors.

For implementation, we should generalize matching from package to namespace to not only depend on the package manager.

Environment

  • Clair version/image: MASTER
@KeyboardNerd KeyboardNerd added priority/high important functionality component/worker labels Dec 10, 2018
@KeyboardNerd KeyboardNerd added this to the v3.0.0 milestone Dec 10, 2018
@KeyboardNerd KeyboardNerd self-assigned this Dec 10, 2018
@KeyboardNerd
Copy link
Contributor Author

This is part of the multiple namespaces work.

@KeyboardNerd
Copy link
Contributor Author

This is fixed by #722

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority/high important functionality
Development

No branches or pull requests

1 participant