rhel

type Coalescer ¶ added in v0.1.0

type Coalescer struct{}

Coalescer takes individual layer artifacts and coalesces them into a full report on the manifest's contents.

Due to the specifics of the RHEL build system, some information needs to be back-propagated. That is to say, some information discovered in later layers is also attributed to earlier layers. Both the product and distribution information work this way.

A Coalescer is safe for concurrent use.

func (*Coalescer) Coalesce(ctx context.Context, artifacts []*indexer.LayerArtifacts) (*claircore.IndexReport, error)

type DistributionScanner ¶ added in v0.0.14

type DistributionScanner struct{}

DistributionScanner implements distribution detection logic for RHEL by looking for an `etc/os-release` file in the layer and failing that, an `etc/redhat-release` file.

The DistributionScanner can be used concurrently.

func (*DistributionScanner) Kind() string

func (*DistributionScanner) Name() string

func (ds *DistributionScanner) Scan(ctx context.Context, l *claircore.Layer) ([]*claircore.Distribution, error)

func (*DistributionScanner) Version() string

type Matcher ¶ added in v0.0.8

type Matcher struct {
	// contains filtered or unexported fields
}

Matcher implements driver.Matcher.

func (*Matcher) Filter(record *claircore.IndexRecord) bool

func (*Matcher) Name() string

func (m *Matcher) Query() []driver.MatchConstraint

func (m *Matcher) Vulnerable(ctx context.Context, record *claircore.IndexRecord, vuln *claircore.Vulnerability) (bool, error)

type MatcherFactory ¶ added in v1.5.29

type MatcherFactory struct {
	// contains filtered or unexported fields
}

func (f *MatcherFactory) Configure(ctx context.Context, cfg driver.MatcherConfigUnmarshaler, _ *http.Client) error

func (f *MatcherFactory) Matcher(ctx context.Context) ([]driver.Matcher, error)

type MatcherFactoryConfig ¶ added in v1.5.29

type MatcherFactoryConfig struct {
	IgnoreUnpatched bool `json:"ignore_unpatched" yaml:"ignore_unpatched"`
}

type PackageScanner ¶ added in v1.5.40

type PackageScanner struct{}

PackageScanner implements a indexer.PackageScanner that consults both the rpm and dnf databases.

func (p PackageScanner) Kind() string

func (p PackageScanner) Name() string

func (p PackageScanner) Scan(ctx context.Context, layer *claircore.Layer) ([]*claircore.Package, error)

func (p PackageScanner) Version() string

type RepositoryScanner ¶ added in v0.1.0

type RepositoryScanner struct {
	// contains filtered or unexported fields
}

RepositoryScanner implements repository detection logic for RHEL.

The RHEL detection logic needs outside information because the Red Hat build system does not (and did not, in the past) store the relevant information in the layer itself. In addition, dnf and yum do not persist provenance information outside of a cache and rpm considers such information outside its baliwick.

In the case of the RHEL ecosystem, "repository" is a bit of a misnomer, as advisories are tracked on the Product level, and so Clair's "repository" data is used instead to indicate a Product. This mismatch can lead to apparent duplication in reporting. For example, if an advisory is marked as affecting "cpe:/a:redhat:enterprise_linux:8" and "cpe:/a:redhat:enterprise_linux:8::appstream", this results in two advisories being recorded. (CPEs do not namespace the way this example may imply; that is to say, the latter is not "contained in" or a "member of" the former.) If a layer reports that it is both the "cpe:/a:redhat:enterprise_linux:8" and "cpe:/a:redhat:enterprise_linux:8::appstream" layer, then both advisories match.

func (r *RepositoryScanner) Configure(ctx context.Context, f indexer.ConfigDeserializer, c *http.Client) error

func (*RepositoryScanner) Kind() string

func (*RepositoryScanner) Name() string

func (r *RepositoryScanner) Scan(ctx context.Context, l *claircore.Layer) ([]*claircore.Repository, error)

func (*RepositoryScanner) Version() string

type RepositoryScannerConfig ¶ added in v1.4.12

type RepositoryScannerConfig struct {
	// Repo2CPEMappingURL can be used to fetch the repo mapping file.
	//
	// See [DefaultRepo2CPEMappingURL] and [repo2cpe].
	Repo2CPEMappingURL string `json:"repo2cpe_mapping_url" yaml:"repo2cpe_mapping_url"`
	// Repo2CPEMappingFile, if specified, is consulted instead of the [Repo2CPEMappingURL].
	//
	// This should be provided to avoid any network traffic.
	Repo2CPEMappingFile string `json:"repo2cpe_mapping_file" yaml:"repo2cpe_mapping_file"`
	// Timeout controls the timeout for any remote calls this package makes.
	//
	// The default is 10 seconds.
	Timeout time.Duration `json:"timeout" yaml:"timeout"`
	// DisableAPI disables the use of the API.
	DisableAPI bool `json:"disable_api" yaml:"disable_api"`
}

RepositoryScannerConfig is the configuration expected for a RepositoryScanner.

Providing the "URL" and "File" members controls how the RepositoryScanner handles updating its mapping file:

• If the "URL" is provided or no configuration is provided, the mapping file is fetched at construction time and then updated periodically.
• If only the "File" is provided, it will be consulted exclusively.
• If both the "URL" and "File" are provided, the file will be loaded initially and then updated periodically from the URL.