Clair report structure/schema/example?

[JWebDev]

Hi,

I am writing a parser for the Clair report. Unfortunately, I do not have the opportunity to simply test to see how the report looks.
I can't find an actual example on the Internet either.

Could you add to the documentation what schema the report has, and also add an example of it (if possible in json format).
Or just throw off here as an answer an example of a report.

How to track possible changes in the report structure? Simply see future release notes?

Thank you!

[crozzy]

The API objects are documented here, examples can be generated from the spec. Any future API changes will be versioned, and the spec will be updated

[hdonnay]

And a rendered version of the spec is here.

[JWebDev]

@hdonnay Thank you. I looked over.
Here: https://quay.github.io/clair/reference/api.html#retrieve-a-vulnerabilityreport-for-a-given-manifests-content-addressable-hash

Another small question, do I understand correctly? One scan generates 1 manifest_hash? So one image scan will generate 1 vulnerability report for me?

[hdonnay]

The Index Report must be created before the Vulnerability Report, correct. They're both referred to by the manifest's digest/hash.

[JWebDev]

@crozzy Thanks for the fast answer.

I cannot generate json vulnerability report example because i need "manifest_hash".
Could you please upload an vulnerability report example here for clarity. Json object makes it much easier to understand.

Thanks!