Add ability to see the first location a package was added #1724
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Alex Goodman <[email protected]>
Benchmark Test ResultsBenchmark results from the latest changes vs base branch |
|
May I know why this pr is not merged . Its extremely helpful in deduping the components across layers |
|
do you have an eta for this addition? can be helpful |
|
Hi @tomerse-sg and @Deep232, thanks for the notes, we don't have an ETA but we will take a look and see if we can move this forward. Thank you for letting us know this would be useful for you! |
|
can you please elaborate about the problem you specified in the PR description? |
|
I tried to run a test using an image golang 1.14 using all-layers and squashed-with-all-layers. |
|
another question - seems this pr is based on syft 0.76.0, do you think it is possible to contribute new pr and aligned it to newest syft? another thing - I think I've found a bug - and when I scan it I do see "jq" |
|
I think this solve the problem of the deleted package - #3138 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds a
squashed-with-all-layersresolver which acts like the squashed resolver with the additional behavior of returning instances of the path found in all other layers. This, combined with additional changes to denote the layer index directly in locations, allows for someone to be able to know the first location a package was introduced.For example:
When running syft...
You'll see merged location elements for each package:
{ "id": "94014313cfcd2b71", "name": "zlib", "version": "1.2.13-r0", "type": "apk", "foundBy": "apkdb-cataloger", "locations": [ { "path": "/lib/apk/db/installed", "layerID": "sha256:0d71e44edab1e63f802dfd59cbf8c128c4f89f2ae3c4edb79475678dcedb5bff" }, { "path": "/lib/apk/db/installed", "layerID": "sha256:a2ea955c0abfa7fb734e0991ef02fb4e4f35e8090ae76cd6f14dc58d037fa23e" }, { "path": "/lib/apk/db/installed", "layerID": "sha256:f1417ff83b319fbdae6dd9cd6d8c9c88002dcd75ecf6ec201c8c6894681cf2b5" } ], "licenses": [ "Zlib" ], "language": "", "cpes": [ "cpe:2.3:a:zlib:zlib:1.2.13-r0:*:*:*:*:*:*:*" ], "purl": "pkg:apk/alpine/[email protected]?arch=x86_64&distro=alpine-3.17.3", ...TODO:
Open question:
Problems:
Closes #435