Feat alma unaffected #2939

willmurphyscode · 2025-09-12T19:44:53Z

This is a better approach for #2745

grype/search/distro.go

wagoodman · 2025-09-18T13:52:59Z

grype/matcher/rpm/almalinux.go

+	// Step 3: Also look for unaffected packages using source/binary RPM relationships
+	relatedUnaffectedResults := findRelatedUnaffectedPackages(provider, searchPkg)
+	// Merge the related results into the main unaffected results
+	for key, results := range relatedUnaffectedResults {
+		unaffectedResults[key] = append(unaffectedResults[key], results...)
+	}
+
+	// Step 4: Update RHEL disclosures with AlmaLinux-specific fix information
+	updatedDisclosures := updateDisclosuresWithAlmaLinuxFixes(disclosures, unaffectedResults, pkgVersion)


I suspect (but have not proven this out) that steps 3 and 4 could leverage the result merge and filter functions.

kzantow · 2025-09-18T15:17:54Z

grype/search/distro.go

 	return "does not match distro(s): " + strings.Join(distroStrs, ", ")
 }

+type ExactDistroCriteria struct {


I instead of adding a new type, would it make the change slightly simpler to add a bool to DistroCriteria { exact bool ... and add a bool to the handleDistro function?

kzantow · 2025-09-18T15:19:37Z

grype/db/v6/search_query.go

 	}
 }

+func (b *searchQueryBuilder) handleExactDistro(c *search.ExactDistroCriteria) {


Essentially the same comment as below: would it be simpler to just add a bool to handleDistro?

willmurphyscode · 2025-09-29T15:44:45Z

grype/matcher/rpm/almalinux.go

+	pkgVersion := version.New(searchPkg.Version, pkg.VersionFormat(searchPkg))
+
+	// Step 1: Find RHEL disclosures for the package
+	disclosures, err := provider.FindResults(


Should additionally check for disclosures on the src rpm.

Signed-off-by: Will Murphy <[email protected]>

Previously, grype treated almalinux as a direct clone of RHEL. Now, in cases where almalinux has a more specific fix version than RHEL does, use the AlmaLinux advisory to remove the match. Signed-off-by: Will Murphy <[email protected]>

Signed-off-by: Will Murphy <[email protected]>

Just set a flag in the existing distro criteria struct instead of making a whole new type. Signed-off-by: Will Murphy <[email protected]>

Signed-off-by: Will Murphy <[email protected]>

The regular RPM matcher doesn't do this either, and there's a very long comment in it about why. Signed-off-by: Will Murphy <[email protected]>

wagoodman · 2025-10-09T13:17:26Z

grype/matcher/internal/only_affected_vulnerabilities.go

+)
+
+// OnlyAffectedVulnerabilities returns a criteria object that filters out unaffected vulnerability records
+func OnlyAffectedVulnerabilities() vulnerability.Criteria {


I think this overlaps (and might do the same thing)

wagoodman · 2025-10-09T13:30:47Z

grype/matcher/rpm/almalinux.go

+func shouldCompletelyFilter(vuln vulnerability.Vulnerability, pkgVersion *version.Version) bool {
+	if !isVersionUnaffected(pkgVersion, vuln.Constraint, vuln.ID) {
+		return false
+	}
+
+	fixVersion := extractFixVersionFromConstraint(vuln.Constraint)
+	return shouldFilterVulnerability(vuln.Constraint, fixVersion, pkgVersion)
+}


having shouldFilterVulnerability vs shouldCompletelyFilter is confusing -- maybe merge them into a single function?

wagoodman · 2025-10-09T13:34:04Z

grype/matcher/rpm/almalinux.go

+		return ""
+	}
+
+	constraintStr := constraint.String()


if you use constraint.Value() you can remove the cleanVersionString function (has no parentheticals)

wagoodman · 2025-10-09T13:34:28Z

grype/matcher/rpm/almalinux.go

+	// Handle common constraint patterns
+	// ">= version" → "version"
+	if strings.HasPrefix(constraintStr, ">= ") {
+		version := strings.TrimPrefix(constraintStr, ">= ")


nit: version clashes with import name

wagoodman · 2025-10-09T13:41:42Z

grype/matcher/rpm/almalinux.go

+	log.WithFields("almaLinuxFixesCount", len(almaLinuxFixes), "unaffectedResultsCount", len(unaffectedResults)).Debug("built AlmaLinux fixes map")
+
+	if len(almaLinuxFixes) == 0 {
+		log.Debug("no AlmaLinux fixes found, returning original disclosures")


nit: this log line provides little value after initial development

wagoodman · 2025-10-09T13:44:25Z

grype/matcher/rpm/almalinux.go

+func identifyVulnerabilitiesToRemove(unaffectedResults result.Set, pkgVersion *version.Version) result.Set {
+	toRemove := make(result.Set)
+
+	for _, unaffectedResultList := range unaffectedResults {
+		for _, unaffectedResult := range unaffectedResultList {
+			for _, vuln := range unaffectedResult.Vulnerabilities {
+				if shouldCompletelyFilter(vuln, pkgVersion) {
+					// Create a result entry to mark this vulnerability for removal
+					toRemove[vuln.ID] = []result.Result{{
+						ID:              vuln.ID,
+						Vulnerabilities: []vulnerability.Vulnerability{vuln},
+					}}
+
+					// Also mark related vulnerabilities (aliases) for removal
+					for _, related := range vuln.RelatedVulnerabilities {
+						toRemove[related.ID] = []result.Result{{
+							ID:              related.ID,
+							Vulnerabilities: []vulnerability.Vulnerability{{Reference: related}},
+						}}
+					}
+				}
+			}
+		}
+	}
+
+	return toRemove
+}


it looks like we are building a set to use later for removal from another set. Could this be better accomplished with the result.Set.Filter() which takes arbitrary criteria functions? That would prevent needing to craft an intermediate set.

ah, I see, you're leveraging the alias processing baked into Remove(). I wonder if that could be extracted and used as a filter function? (consider this non-blocking; I'm trying to find ways to make this easier to read and reason about)

wagoodman · 2025-10-09T13:46:47Z

grype/matcher/rpm/almalinux.go

+}
+
+// updateRemainingWithAlmaLinuxFixes updates remaining vulnerabilities with AlmaLinux fix information
+func updateRemainingWithAlmaLinuxFixes(disclosures result.Set, unaffectedResults result.Set) result.Set {


this really looks like it should be a result.Set.Merge() with a custom function to control behavior

Signed-off-by: Will Murphy <[email protected]>

There are fewer gaps in ALSAs than previously thought. Signed-off-by: Will Murphy <[email protected]>

This data will instead be added to vunnel, so that cleaning it up doesn't require a code release. Signed-off-by: Will Murphy <[email protected]>

Signed-off-by: Will Murphy <[email protected]>

wagoodman · 2025-10-15T17:50:09Z

grype/matcher/internal/result/results.go

+// For example, if the current set has CVE-2006-20001 and the incoming set has ALSA-2023:0852
+// with alias CVE-2006-20001, the updateFunc will be called to update the CVE entry with data
+// from the ALSA entry.
+func (s Set) UpdateByIdentity(incoming Set, updateFunc func(existing *Result, incoming Result)) Set {


from our conversation, I feel like this (one day) could be a little more generic. This is a pretty specific functionality on a generic set implementation. We don't have to block on that now since this is in internal.

From what we chatted about the set intersectoin and getIdentity logic out and passed in as a "key function", thus this really changes from UpdateByIdentity to just Update. Odds are something like this can be done to Merge. TBD on removing of elements, but I feel that could be a separate call to Filter or Remove before hand.

wagoodman · 2025-10-15T17:56:56Z

grype/matcher/rpm/almalinux.go

+	if strings.HasPrefix(constraintStr, ">= ") {
+		return strings.TrimPrefix(constraintStr, ">= ")
+	}


Suggested change

if strings.HasPrefix(constraintStr, ">= ") {

return strings.TrimPrefix(constraintStr, ">= ")

}

if strings.HasPrefix(constraintStr, ">=") {

return strings.TrimSpace(strings.TrimPrefix(constraintStr, ">="))

}

nit, we can use these https://github.com/anchore/grype/blob/main/grype/version/operator.go

wagoodman · 2025-10-15T18:04:07Z

grype/matcher/internal/result/results_test.go

+					},
+				},
+			},
+			mergeFuncs: []func(existing, incoming []Result) []Result{


this test could probably be deleted

wagoodman · 2025-10-15T18:06:24Z

grype/matcher/internal/result/results_test.go

+			got := filtered.UpdateByIdentity(tt.unaffectedResults, func(existing *Result, incoming Result) {
+				for i := range existing.Vulnerabilities {
+					for _, incomingVuln := range incoming.Vulnerabilities {
+						existing.Vulnerabilities[i].Fix = incomingVuln.Fix
+						existing.Vulnerabilities[i].Advisories = incomingVuln.Advisories
+					}
+				}


this feels kinda an odd/complicated way to test this

wagoodman · 2025-10-15T18:07:07Z

grype/matcher/internal/result/results_test.go

+			got := tt.base.UpdateByIdentity(tt.incoming, func(existing *Result, incoming Result) {
+				// Update fix information from incoming
+				for i := range existing.Vulnerabilities {
+					for _, incomingVuln := range incoming.Vulnerabilities {
+						existing.Vulnerabilities[i].Fix = incomingVuln.Fix
+						existing.Vulnerabilities[i].Advisories = incomingVuln.Advisories
+					}


duplicate test?

wagoodman · 2025-10-15T18:10:08Z

grype/matcher/rpm/almalinux_test.go

+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filtered := tt.disclosures.Remove(tt.unaffectedResults)


I think this is already covered by https://github.com/anchore/grype/blob/v0.101.0/grype/matcher/internal/result/results_test.go#L118-L285 in the result package

wagoodman · 2025-10-15T18:13:24Z

grype/matcher/rpm/almalinux_test.go

+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filtered := tt.disclosures.Remove(tt.unaffected)


probably the r=wrong subject under test

Signed-off-by: Will Murphy <[email protected]>

This lets the caller pass in a predicate rather than fixing the predicate used to determine what should be updated. Signed-off-by: Will Murphy <[email protected]>

willmurphyscode force-pushed the feat-alma-unaffected branch from eb0cb13 to c24673b Compare September 17, 2025 20:30

wagoodman reviewed Sep 18, 2025

View reviewed changes

grype/search/distro.go Outdated Show resolved Hide resolved

wagoodman reviewed Sep 18, 2025

View reviewed changes

kzantow reviewed Sep 18, 2025

View reviewed changes

willmurphyscode commented Sep 29, 2025

View reviewed changes

willmurphyscode added 14 commits October 7, 2025 09:07

feat: use almalinux advisories to filter alma matches

ab3f2c0

Signed-off-by: Will Murphy <[email protected]>

debugsource and debuginfo never vulnerable on alma

95e761d

Signed-off-by: Will Murphy <[email protected]>

use result set instead of manual filtering

2fa5925

Signed-off-by: Will Murphy <[email protected]>

update fixes to alma fixes used

9c1be94

Signed-off-by: Will Murphy <[email protected]>

add unaliased distro search capability

e9c4c17

Signed-off-by: Will Murphy <[email protected]>

ensure ALSAs can remove CVEs on AlmaLinux scans

49d16bf

Signed-off-by: Will Murphy <[email protected]>

lint fixes

576a6ba

Signed-off-by: Will Murphy <[email protected]>

use result set merge and filter

e06bbe5

Signed-off-by: Will Murphy <[email protected]>

simplify exact distro search

afb1421

Just set a flag in the existing distro criteria struct instead of making a whole new type. Signed-off-by: Will Murphy <[email protected]>

wip

c3993b0

Signed-off-by: Will Murphy <[email protected]>

wip

b9424b8

Signed-off-by: Will Murphy <[email protected]>

always set alma advisory if available

92e23c6

Signed-off-by: Will Murphy <[email protected]>

set advisories

cb738cc

Signed-off-by: Will Murphy <[email protected]>

willmurphyscode force-pushed the feat-alma-unaffected branch from cabf4b1 to cb738cc Compare October 8, 2025 17:30

stop adding epochs to src rpm versions in Alma matcher

d41fa4e

The regular RPM matcher doesn't do this either, and there's a very long comment in it about why. Signed-off-by: Will Murphy <[email protected]>

willmurphyscode marked this pull request as ready for review October 8, 2025 20:03

willmurphyscode mentioned this pull request Oct 8, 2025

Feat non language OSV anchore/grype-db#686

Draft

1 task

wagoodman reviewed Oct 9, 2025

View reviewed changes

willmurphyscode added 8 commits October 13, 2025 13:42

more alma unit tests

a7970ab

Signed-off-by: Will Murphy <[email protected]>

additional alma test - module build number fp

6ccef84

Signed-off-by: Will Murphy <[email protected]>

add final almalinux tests

4a690e5

Signed-off-by: Will Murphy <[email protected]>

simplify filtering logic

9034907

Signed-off-by: Will Murphy <[email protected]>

add UpdateByIdentity for result set

a499661

Signed-off-by: Will Murphy <[email protected]>

simplify related names work

85e21e4

There are fewer gaps in ALSAs than previously thought. Signed-off-by: Will Murphy <[email protected]>

remove map of missing packages from ALSAs

10dd4e6

This data will instead be added to vunnel, so that cleaning it up doesn't require a code release. Signed-off-by: Will Murphy <[email protected]>

clean up some redundant functions

06c2481

Signed-off-by: Will Murphy <[email protected]>

wagoodman reviewed Oct 15, 2025

View reviewed changes

willmurphyscode added 4 commits October 15, 2025 16:39

fix unit tests for result set

9d67c64

Signed-off-by: Will Murphy <[email protected]>

remove redundant test

621e7a8

Signed-off-by: Will Murphy <[email protected]>

more test clean up in rhel disclosures

f6b97d0

Signed-off-by: Will Murphy <[email protected]>

replace UpdateByIdentity with Update

672109c

This lets the caller pass in a predicate rather than fixing the predicate used to determine what should be updated. Signed-off-by: Will Murphy <[email protected]>

Feat alma unaffected #2939

Are you sure you want to change the base?

Feat alma unaffected #2939

Conversation

willmurphyscode commented Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

willmurphyscode commented Sep 12, 2025 •

edited

Loading