Skip to content

Write RHEL advisory IDs in os transformer #707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Oct 6, 2025
Merged

Write RHEL advisory IDs in os transformer #707

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ec40e16
add advisory id in os transform
willmurphyscode Oct 3, 2025
bdd2336
fix transform unit tests
willmurphyscode Oct 3, 2025
8db901f
get grype from advisory-id branch
willmurphyscode Oct 6, 2025
e7f5f5b
make advisory key a proper struct
willmurphyscode Oct 6, 2025
f9945b7
chore: get grype from main
willmurphyscode Oct 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ require (
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
github.com/adrg/xdg v0.5.3
github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722
github.com/anchore/grype v0.100.1-0.20251003151438-d56b008a071c
github.com/anchore/grype v0.100.1-0.20251006201333-492e4e467f36
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115
github.com/anchore/syft v1.33.0
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de
Expand Down Expand Up @@ -60,7 +60,7 @@ require (
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20250520111509-a70c2aa677fa // indirect
github.com/BurntSushi/toml v1.5.0 // indirect
github.com/CycloneDX/cyclonedx-go v0.9.2 // indirect
github.com/CycloneDX/cyclonedx-go v0.9.3 // indirect
github.com/DataDog/zstd v1.5.7 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
Expand Down Expand Up @@ -146,7 +146,7 @@ require (
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/cli v28.4.0+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker v28.4.0+incompatible // indirect
github.com/docker/docker v28.5.0+incompatible // indirect
github.com/docker/docker-credential-helpers v0.9.3 // indirect
github.com/docker/go-connections v0.6.0 // indirect
github.com/docker/go-events v0.0.0-20250114142523-c867878c5e32 // indirect
Expand Down Expand Up @@ -226,7 +226,7 @@ require (
github.com/nwaples/rardecode/v2 v2.1.1 // indirect
github.com/olekukonko/errors v1.1.0 // indirect
github.com/olekukonko/ll v0.0.9 // indirect
github.com/olekukonko/tablewriter v1.0.9 // indirect
github.com/olekukonko/tablewriter v1.1.0 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/opencontainers/runtime-spec v1.2.1 // indirect
Expand Down
16 changes: 8 additions & 8 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,8 @@ github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbi
github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
github.com/CycloneDX/cyclonedx-go v0.9.2 h1:688QHn2X/5nRezKe2ueIVCt+NRqf7fl3AVQk+vaFcIo=
github.com/CycloneDX/cyclonedx-go v0.9.2/go.mod h1:vcK6pKgO1WanCdd61qx4bFnSsDJQ6SbM2ZuMIgq86Jg=
github.com/CycloneDX/cyclonedx-go v0.9.3 h1:Pyk/lwavPz7AaZNvugKFkdWOm93MzaIyWmBwmBo3aUI=
github.com/CycloneDX/cyclonedx-go v0.9.3/go.mod h1:vcK6pKgO1WanCdd61qx4bFnSsDJQ6SbM2ZuMIgq86Jg=
github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
github.com/DataDog/zstd v1.5.7 h1:ybO8RBeh29qrxIhCA9E8gKY6xfONU9T6G6aP9DTKfLE=
github.com/DataDog/zstd v1.5.7/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
Expand Down Expand Up @@ -155,8 +155,8 @@ github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04 h1:VzprUTpc0v
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04/go.mod h1:6dK64g27Qi1qGQZ67gFmBFvEHScy0/C8qhQhNe5B5pQ=
github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4 h1:rmZG77uXgE+o2gozGEBoUMpX27lsku+xrMwlmBZJtbg=
github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E=
github.com/anchore/grype v0.100.1-0.20251003151438-d56b008a071c h1:DMo2PRkzJ7XxvUpcowkC7vVmux6VEqcXhUoxRMJKnyc=
github.com/anchore/grype v0.100.1-0.20251003151438-d56b008a071c/go.mod h1:KIZ4MCbYePnA7syqKKKtOjNij5GwRahPAakp7ZutanY=
github.com/anchore/grype v0.100.1-0.20251006201333-492e4e467f36 h1:s2HhMqqg5Yvnpzp5+XofF0tPYDWTh4pwvJJIy/bu7Gk=
github.com/anchore/grype v0.100.1-0.20251006201333-492e4e467f36/go.mod h1:/smKEsU6bkAO5UjqpJfyHBUB3O386+HiOkj8tf8jA38=
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 h1:ZyRCmiEjnoGJZ1+Ah0ZZ/mKKqNhGcUZBl0s7PTTDzvY=
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115/go.mod h1:KoYIv7tdP5+CC9VGkeZV4/vGCKsY55VvoG+5dadg4YI=
github.com/anchore/stereoscope v0.1.10 h1:BogafIMaW/L1lOUoVS96Hu1jTSP2JktxIayVqcxvcBI=
Expand Down Expand Up @@ -348,8 +348,8 @@ github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY
github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk=
github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker v28.5.0+incompatible h1:ZdSQoRUE9XxhFI/B8YLvhnEFMmYN9Pp8Egd2qcaFk1E=
github.com/docker/docker v28.5.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
Expand Down Expand Up @@ -794,8 +794,8 @@ github.com/olekukonko/errors v1.1.0 h1:RNuGIh15QdDenh+hNvKrJkmxxjV4hcS50Db478Ou5
github.com/olekukonko/errors v1.1.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
github.com/olekukonko/ll v0.0.9 h1:Y+1YqDfVkqMWuEQMclsF9HUR5+a82+dxJuL1HHSRpxI=
github.com/olekukonko/ll v0.0.9/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g=
github.com/olekukonko/tablewriter v1.0.9 h1:XGwRsYLC2bY7bNd93Dk51bcPZksWZmLYuaTHR0FqfL8=
github.com/olekukonko/tablewriter v1.0.9/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
github.com/olekukonko/tablewriter v1.1.0 h1:N0LHrshF4T39KvI96fn6GT8HEjXRXYNDrDjKFDB7RIY=
github.com/olekukonko/tablewriter v1.1.0/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
Expand Down
22 changes: 15 additions & 7 deletions pkg/process/v6/transformers/os/transform.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,13 @@ import (
"github.com/anchore/syft/syft/pkg"
)

// advisoryKey is an internal struct used for sorting and deduplicating advisories
// that have both a link and ID from the vunnel results data
type advisoryKey struct {
id string
link string
}

func Transform(vulnerability unmarshal.OSVulnerability, state provider.State) ([]data.Entry, error) {
in := []any{
grypeDB.VulnerabilityHandle{
Expand Down Expand Up @@ -106,19 +113,20 @@ func getFix(fixedInEntry unmarshal.OSFixedIn) *grypeDB.Fix {
fixState = grypeDB.WontFixStatus
}

var linkOrder []string
linkSet := strset.New()
var advisoryOrder []advisoryKey
advisorySet := strset.New()
for _, a := range fixedInEntry.VendorAdvisory.AdvisorySummary {
if a.Link != "" && !linkSet.Has(a.Link) {
linkOrder = append(linkOrder, a.Link)
linkSet.Add(a.Link)
if a.Link != "" && !advisorySet.Has(a.Link) {
advisoryOrder = append(advisoryOrder, advisoryKey{id: a.ID, link: a.Link})
advisorySet.Add(a.Link)
}
}

var refs []grypeDB.Reference
for _, l := range linkOrder {
for _, adv := range advisoryOrder {
refs = append(refs, grypeDB.Reference{
URL: l,
ID: adv.id,
URL: adv.link,
Tags: []string{grypeDB.AdvisoryReferenceTag},
})
}
Expand Down
8 changes: 8 additions & 0 deletions pkg/process/v6/transformers/os/transform_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -956,6 +956,7 @@ func TestTransform(t *testing.T) {
},
References: []grypeDB.Reference{
{
ID: "RHSA-2020:1341",
URL: "https://access.redhat.com/errata/RHSA-2020:1341",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand Down Expand Up @@ -983,6 +984,7 @@ func TestTransform(t *testing.T) {
Detail: &grypeDB.FixDetail{
References: []grypeDB.Reference{
{
ID: "RHSA-2020:1495",
URL: "https://access.redhat.com/errata/RHSA-2020:1495",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand Down Expand Up @@ -1052,6 +1054,7 @@ func TestTransform(t *testing.T) {
Detail: &grypeDB.FixDetail{
References: []grypeDB.Reference{
{
ID: "RHSA-2020:3669",
URL: "https://access.redhat.com/errata/RHSA-2020:3669",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand Down Expand Up @@ -1081,6 +1084,7 @@ func TestTransform(t *testing.T) {
Detail: &grypeDB.FixDetail{
References: []grypeDB.Reference{
{
ID: "RHSA-2020:5620",
URL: "https://access.redhat.com/errata/RHSA-2020:5620",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand Down Expand Up @@ -1110,6 +1114,7 @@ func TestTransform(t *testing.T) {
Detail: &grypeDB.FixDetail{
References: []grypeDB.Reference{
{
ID: "RHSA-2020:5619",
URL: "https://access.redhat.com/errata/RHSA-2020:5619",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand Down Expand Up @@ -1422,6 +1427,7 @@ func TestGetFixWithDetail(t *testing.T) {
},
References: []grypeDB.Reference{
{
ID: "RHSA-2023-001",
URL: "https://access.redhat.com/errata/RHSA-2023-001",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand Down Expand Up @@ -1541,6 +1547,7 @@ func TestGetFixWithDetailFixtures(t *testing.T) {
},
References: []grypeDB.Reference{
{
ID: "RHSA-2020:1341",
URL: "https://access.redhat.com/errata/RHSA-2020:1341",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand All @@ -1553,6 +1560,7 @@ func TestGetFixWithDetailFixtures(t *testing.T) {
Detail: &grypeDB.FixDetail{
References: []grypeDB.Reference{
{
ID: "RHSA-2020:1495",
URL: "https://access.redhat.com/errata/RHSA-2020:1495",
Tags: []string{grypeDB.AdvisoryReferenceTag},
},
Expand Down