Dealing with non deb-version version schemes

[alexandernst]

I'm currently in charge of writing a fetcher plugin for a custom vulnerability source. That source provides NPM-like versions for the packages, and those fail to be parsed by version.NewVersion method.

Examples:

<4.1.2 >=4.0.0
<3.8.39 >=3.5.5 || <4.3.6 >=4.0.0
<3.4.6 || > 4.0.0 <4.0.5

How should I deal with this situation?

Related to #293

[Djelibeybi]

The framework for this was added in #298 so check that out and perhaps extend that for NPM.

[jzelinskie]

The HEAD of clair now has versionfmts for this reason. Rather, the reason you don't seen support for npm and pip in Clair just yet is because images containers can only have one namespace. We're hoping to remove this limitation in the near future.

[jzelinskie]

I'm going to close this, we should create a new issue for supporting verison ranges