How to detect new distro releases?

[crozzy]

Clair follows the pattern of adding boilerplate code for every new distro release (see: quay/claircore#464). This means that we can miss releases, resulting in false positives (or false negatives depending on how positive you consider image vulnerabilities to be 😄).

I can think of 3 ways to help this problem, each varying in complexity:

• Some alerting mechanism (possibly incorporated in the CI) that can query distro information and report back discrepancies to inform manual code updates.
• Same as above but with code-gen at the end.
• Dynamically detect distro versions at scanning and matching time (I'm not sure how feasible this would be and how much it would lead to other problems).

[hdonnay]

I vote for the third option

[crozzy]

I tend to agree, maximum hands off approach. In that case, we'll probably have to re think the index_state and the scanner version. If an new version is dynamically added/queried for is that a different scanner version?

[hdonnay]

I don't think it would need to -- it should return the same thing unless the distro heuristic changes.

For example, if someone were to create a "fake" debian release (say "Buzz" as 11 instead of "Bullseye") we'd always create that, and if they changed to the "real" release, that'd be a new layer.

[crozzy]

I guess I'm thinking of layers (like "Bullseye" for example) that could have been scanned currently (i.e. in existing deployments), and then we roll out this change, the caller would presume that nothing has changed. I suppose we can mitigate around that, seems quite corner-case-y.

Yes, if Clair is prepared for a release before someone pushes a manifest with a layer purporting to be that release then the scanner version is moot.

[hdonnay]

Ah, when we update the heuristic, we need to make sure to change the scanner version.