Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Distinguish OS package vs unofficial packages #2549

Open
5 tasks
wagoodman opened this issue Jan 25, 2024 · 3 comments
Open
5 tasks

Distinguish OS package vs unofficial packages #2549

wagoodman opened this issue Jan 25, 2024 · 3 comments
Labels
enhancement New feature or request planning high level epic that should be broken into smaller tasks

Comments

@wagoodman
Copy link
Contributor

wagoodman commented Jan 25, 2024 •
edited by kzantow
Loading

Today syft does not distinguish between RPMs from the official distro provider vs RPMs that were curled and installed from unofficial sources. This is valuable to detect, and applies to mulitple ecosystems, but the solution is not straight forward or obvious in all cases.

The ecosystems to cover should at least be all of the OS distros we support:
@wagoodman wagoodman added the enhancement New feature or request label Jan 25, 2024
@wagoodman
Copy link
Contributor Author

There is a ongoing conversation about how to do this with alpine packages: anchore/grype#827 . As of this time it isn't clear what the way forward is for alpine.

@wagoodman
Copy link
Contributor Author

wagoodman commented Jan 25, 2024 •
edited
Loading

There is also another issue that talks about multiple ecosystems, primarily Redhat and Debian #1607

@wagoodman wagoodman added the planning high level epic that should be broken into smaller tasks label Jan 25, 2024
@westonsteimel
Copy link
Contributor

What about an approach in grype in the meantime within SearchByDistro where it would first search in the distro namespace for any packages matching the name (or parent package name), and if it finds nothing fall back to CPE matching? Maybe make it configurable or something?

@witchcraze witchcraze mentioned this issue Feb 21, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request planning high level epic that should be broken into smaller tasks
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@wagoodman @westonsteimel