feat(pkg/sbom/cpe.go): Add exception for gitlab-operator to avoid matching as gitlab-* package and gitlab product #1755
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ching as gitlab-* package and gitlab product
Not all gitlab-* packages should be treated as GitLab, but most of them are - as seen in
```
if strings.HasPrefix(name, "gitlab-") {
attr.Vendor = "gitlab"
attr.Product = "gitlab"
attr.SWEdition = "community"
return &attr
}
```
Added in wolfi-dev@1c050aa
One notable exception is gitlab-operator, which is a Kubernetes operator
for managing GitLab installations, and not part of GitLab itself with
source @ https://gitlab.com/gitlab-org/cloud-native/gitlab-operator
Adding an explicit exception for this package to not match on `gitlab-*`
The reason for this change is because new gitlab-operator package was being matched with all older gitlab CVEs which is incorrect.
Signed-off-by: philroche <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Not all gitlab-* packages should be treated as GitLab, but most of them are - as seen in
Added in 1c050aa
One notable exception is gitlab-operator, which is a Kubernetes operator
for managing GitLab installations, and not part of GitLab itself with
source @ https://gitlab.com/gitlab-org/cloud-native/gitlab-operator
Adding an explicit exception for this package to not match on
gitlab-*The reason for this change is because new gitlab-operator package was being matched with all older gitlab CVEs which is incorrect.
Signed-off-by: philroche [email protected]