Add SLES 16.0

[dirkmueller]

No description provided.

[dirkmueller]

ok, further investigations hows that it needs to have a syft sbom on ghcr.io/anchore/vml-sbom which means I cannot contribute this myself :/

[willmurphyscode]

ok, further investigations hows that it needs to have a syft sbom on ghcr.io/anchore/vml-sbom which means I cannot contribute this myself :/

Can you help me understand what you mean by this? Did you see an error that referenced this ghcr.io URL or something?

It is absolutely our intention that folks can contribute to vunnel (and we really appreciate it!). If you're blocked I would love to help unblock you.

You do probably need to change https://github.com/anchore/vunnel/blob/main/src/vunnel/providers/sles/__init__.py#L25 which will make a couple config tests fail, and you can update those.

[dirkmueller]

Can you help me understand what you mean by this? Did you see an error that referenced this ghcr.io URL or something?

Yes, here: https://github.com/anchore/vunnel/blob/main/tests/quality/Makefile#L9

in tests/quality/config.yaml I referred to a SLES 16.0 image (the bci-base one) that should have findings.

It is absolutely our intention that folks can contribute to vunnel (and we really appreciate it!). If you're blocked I would love to help unblock you.

my main issue is that I don't know the overall picture to get grype to use the SUSE provided oval2 data for vulnerability detection rather than upstream version ranges (which are often wrong for SLES as we do backports by default). Our customers are very upset about the (false positives) findings. I tried extending tests/unit/providers/sles with 16.0 fixtures, but I can not figure out how the fixtures are being generated, or how I can upload the sbom references it looks for to the sbom store.

You do probably need to change https://github.com/anchore/vunnel/blob/main/src/vunnel/providers/sles/__init__.py#L25 which will make a couple config tests fail, and you can update those.

thank you! updated.

[dirkmueller]

@willmurphyscode could you please add the run-pr-quality-gate label and rerun the test? I am not permitted to modify labels

[willmurphyscode]

@dirkmueller the quality gate won't pass right now (I tested it locally - it uses a lot of CI minutes which is why it doesn't run by default.) (All I did was cd into ./tests/quality and run make provider=sles and watch it error out. The labeling is really tedious and it's on my list of things to make it easier for contributors to do.)

I'll get the labels PR merged and then add then help you get this green and landed. Thanks for this! It's been on my list for a long time.

[willmurphyscode]

ok! Now I that anchore/vulnerability-match-labels#202 is merged the remaining work needed on this PR is:

1. update the submodule at ./tests/quality/vulnerability-match-labels to point to anchore/vulnerability-match-labels@1fc1dd4 or later
2. Move the year to 2024 at https://github.com/anchore/vunnel/blob/main/tests/quality/config.yaml#L373 - there's a good example at https://github.com/anchore/vunnel/blob/main/tests/quality/config.yaml#L459

[dirkmueller]

Thanks for the help here, much appreciated! now I see this:

Deltas for registry.suse.com/bci/bci-base@sha256:ae18370c24511ed8b9d6d5376260663f5e535e0d52b0803a9e3e7858760606bf:
Match differences between tooling (with labels):
   TOOL PARTITION                               PACKAGE                        VULNERABILITY   LABEL         COMMENTARY
   grype[custom-db]@v0.112.0-31-g4f57d030 ONLY  libgcrypt20@1.11.1-160000.2.2  CVE-2024-2236   TruePositive  (this is a new TP 🙌)
   grype[custom-db]@v0.112.0-31-g4f57d030 ONLY  libgpg-error0@1.54-160000.2.2  CVE-2024-2236   TruePositive  (this is a new TP 🙌)
   grype[custom-db]@v0.112.0-31-g4f57d030 ONLY  libz1@1.2.13-160000.2.2        CVE-2023-45853  TruePositive  (this is a new TP 🙌)
   grype[custom-db]@v0.112.0-31-g4f57d030 ONLY  pam@1.7.1-160000.2.2           CVE-2024-10041  TruePositive  (this is a new TP 🙌)

--------------------------------------------------------------------------------

Quality gate passed!

which looks good (these are fixes missing in that old image).