fix: Ignore dpkg entries that have "deinstall" status#4231
fix: Ignore dpkg entries that have "deinstall" status#4231kzantow merged 1 commit intoanchore:mainfrom
Conversation
…as been removed but not purged Signed-off-by: Ross Kirk <ross.kirk@upwind.io>
|
comments from community meeting - @spiffcs will review the notes from last week livestream where we discussed a config rule to add onto this feature, commit the config, and then add a review and get this over the line |
|
👋 Apologies for the delay on this one from yesterday's meeting - we're going over what this might look like for grype users when grype is updated to use which ever syft this lands in. We're getting some extra opinions on the config option vs land as is and it fixes a whole bunch of FPs that otherwise people would not want. Will update and merge/contribute and review when we get a good answer on how to fit this change into grype 😄 |
|
cc @wagoodman for Monday where we can talk about the cataloger conventions and what it looks like having 4 cataloger constructors with 2 tasks when two of them are moving to deprecated status |
51159ce to
9b60b3e
Compare
kzantow
left a comment
There was a problem hiding this comment.
We decided that this was indeed probably just a bug, and didn't need configuration, so I reverted the PR to your original change @rkirk-nos, thanks much for your contribution!
|
@kzantow appreciate all the efforts to help land the change, thanks everyone! |
…o longer considered Due to the following PRs in syft, some matches which were previously TPs should now be considered FPs: - anchore/syft#4231 - anchore/syft#4558 Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
…o longer considered (#179) Due to the following PRs in syft, some matches which were previously TPs should now be considered FPs: - anchore/syft#4231 - anchore/syft#4558 Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
Description
Ignore dpkg entries that have "deinstall" status indicating package has been removed but not purged.
When running
dpkg -lthese entries typically show asrcindicating the package has been removed but configuration still remains on the asset such as the following exampleFrequently this can be seen when scanning a host instance, rather than a container, where old kernel packages are automatically removed but not purged resulting in them being present in the SBOM and assigned vulnerabilities against these removed packages when performing a Grype scan.
deinstalledstate should not be in SBOM #3063Type of change
Checklist: