anchore · willmurphyscode · Oct 21, 2025 · Sep 10, 2025 · Sep 12, 2025 · Sep 12, 2025
diff --git a/grype/db/v6/operating_system_store.go b/grype/db/v6/operating_system_store.go
@@ -33,6 +33,9 @@ type OSSpecifier struct {
 
 	// Channel is a string that represents a different feed for fix and vulnerability data (e.g. "eus" for RHEL)
 	Channel string
+
+	// DisableAliasing prevents OS aliasing when true (used for exact distro matching)
+	DisableAliasing bool
 }
 
 func (d *OSSpecifier) clean() {
@@ -201,8 +204,11 @@ func (s *operatingSystemStore) GetOperatingSystems(d OSSpecifier) ([]OperatingSy
 	// search for aliases for the given distro; we intentionally map some OSs to other OSs in terms of
 	// vulnerability (e.g. `centos` is an alias for `rhel`). If an alias is found always use that alias in
 	// searches (there will never be anything in the DB for aliased distros).
-	if err := s.applyOSAlias(&d); err != nil {
-		return nil, err
+	// Skip aliasing if explicitly disabled (used for exact distro matching).
+	if !d.DisableAliasing {
+		if err := s.applyOSAlias(&d); err != nil {
+			return nil, err
+		}
 	}
 
 	d.clean()

diff --git a/grype/db/v6/search_query.go b/grype/db/v6/search_query.go
@@ -153,6 +153,7 @@ func (b *searchQueryBuilder) handleDistro(c *search.DistroCriteria) {
 				RemainingVersion: d.RemainingVersion(),
 				LabelVersion:     d.Codename,
 				Channel:          channel,
+				DisableAliasing:  c.Exact,
 			})
 		}
 		if foundChannels == 0 {
@@ -162,6 +163,7 @@ func (b *searchQueryBuilder) handleDistro(c *search.DistroCriteria) {
 				MinorVersion:     d.MinorVersion(),
 				RemainingVersion: d.RemainingVersion(),
 				LabelVersion:     d.Codename,
+				DisableAliasing:  c.Exact,
 			})
 		}
 	}

diff --git a/grype/db/v6/search_query_test.go b/grype/db/v6/search_query_test.go
@@ -284,6 +284,66 @@ func TestQueryBuilder_Build(t *testing.T) {
 	require.Len(t, remaining, 1)
 }
 
+func TestQueryBuilder_ExactDistroCriteria(t *testing.T) {
+	tests := []struct {
+		name     string
+		criteria []vulnerability.Criteria
+		validate func(t *testing.T, query *searchQuery, remaining []vulnerability.Criteria)
+	}{
+		{
+			name: "exact distro criteria should be handled with DisableAliasing set",
+			criteria: []vulnerability.Criteria{
+				search.ByExactDistro(*distro.New(distro.AlmaLinux, "8", "")),
+			},
+			validate: func(t *testing.T, query *searchQuery, remaining []vulnerability.Criteria) {
+				require.Len(t, query.osSpecs, 1)
+				require.Equal(t, "almalinux", query.osSpecs[0].Name)
+				require.Equal(t, "8", query.osSpecs[0].MajorVersion)
+				require.True(t, query.osSpecs[0].DisableAliasing, "ExactDistroCriteria should set DisableAliasing=true")
+				require.Empty(t, remaining, "ExactDistroCriteria should be handled, not left in remaining")
+			},
+		},
+		{
+			name: "exact distro criteria should not be left in remaining criteria",
+			criteria: []vulnerability.Criteria{
+				search.ByPackageName("mariadb"),
+				search.ByExactDistro(*distro.New(distro.AlmaLinux, "8", "")),
+				search.ForUnaffected(),
+			},
+			validate: func(t *testing.T, query *searchQuery, remaining []vulnerability.Criteria) {
+				require.NotNil(t, query.pkgSpec)
+				require.Equal(t, "mariadb", query.pkgSpec.Name)
+				require.Len(t, query.osSpecs, 1)
+				require.Equal(t, "almalinux", query.osSpecs[0].Name)
+				require.True(t, query.osSpecs[0].DisableAliasing, "ExactDistroCriteria should set DisableAliasing=true")
+				require.True(t, query.unaffectedOnly)
+				require.Empty(t, remaining, "ExactDistroCriteria should be handled, not left in remaining")
+			},
+		},
+		{
+			name: "regular distro criteria should not set DisableAliasing",
+			criteria: []vulnerability.Criteria{
+				search.ByDistro(*distro.New(distro.AlmaLinux, "8", "")),
+			},
+			validate: func(t *testing.T, query *searchQuery, remaining []vulnerability.Criteria) {
+				require.Len(t, query.osSpecs, 1)
+				require.Equal(t, "almalinux", query.osSpecs[0].Name)
+				require.Equal(t, "8", query.osSpecs[0].MajorVersion)
+				require.False(t, query.osSpecs[0].DisableAliasing, "Regular DistroCriteria should keep DisableAliasing=false")
+				require.Empty(t, remaining)
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			query, remaining, err := newSearchQuery(test.criteria)
+			require.NoError(t, err)
+			test.validate(t, query, remaining)
+		})
+	}
+}
+
 func TestQueryBuilder_IntegrationWithRealCriteria(t *testing.T) {
 	// test the full flow that mimics parseCriteria behavior
 	criteria := []vulnerability.Criteria{

diff --git a/grype/matcher/internal/result/results.go b/grype/matcher/internal/result/results.go
@@ -213,6 +213,49 @@ func (s Set) Intersection(other Set) Set {
 	return out
 }
 
+// IdentitiesOverlap returns true if two results share any common identifiers, where identity
+// includes both the primary ID and any aliases (from RelatedVulnerabilities). This can be used
+// as a shouldUpdate predicate for Update when matching results by ID or alias relationships.
+func IdentitiesOverlap(existing Result, incoming Result) bool {
+	existingIdentity := getIdentity(existing.ID, []Result{existing})
+	incomingIdentity := getIdentity(incoming.ID, []Result{incoming})
+	return !strset.Intersection(existingIdentity, incomingIdentity).IsEmpty()
+}
+
+// Update applies an update function to each result in the set where shouldUpdate returns true
+// for the existing-incoming result pair. The updateFunc can modify fields of the existing result
+// in-place while preserving other fields. Returns a new Set with updated results.
+//
+// Example with identity-based matching:
+//
+//	updated := base.Update(incoming, IdentitiesOverlap, func(existing *Result, incoming Result) {
+//	    existing.Vulnerabilities[0].Fix = incoming.Vulnerabilities[0].Fix
+//	})
+func (s Set) Update(incoming Set, shouldUpdate func(existing Result, incoming Result) bool, updateFunc func(existing *Result, incoming Result)) Set {
+	out := make(Set)
+
+	// Copy everything from base set
+	for id, results := range s {
+		out[id] = append([]Result(nil), results...)
+	}
+
+	// For each entry in base, check all incoming entries with shouldUpdate
+	for id, existingResults := range out {
+		for i := range existingResults {
+			for _, incomingResults := range incoming {
+				for _, incomingResult := range incomingResults {
+					if shouldUpdate(existingResults[i], incomingResult) {
+						updateFunc(&existingResults[i], incomingResult)
+					}
+				}
+			}
+		}
+		out[id] = existingResults
+	}
+
+	return out
+}
+
 func (s Set) Filter(criteria ...vulnerability.Criteria) Set {
 	out := Set{}
 	for id, results := range s {