Add Ubuntu ESM vulnerability matching#3546
Open
wagoodman wants to merge 6 commits into
Open
Conversation
Handles Ubuntu ESM as a distro `esm` channel, modeled on the existing RHEL EUS support. When a scanned Ubuntu image is Pro/ESM-enabled, a two-pass match resolves base disclosures against the ESM-channel fixes, so users see `fixed in ...+esm1` instead of a bare wont-fix. Non-Pro scans are unchanged: the same CVEs still show as vulnerable/wont-fix. Off by default. Turns on when ESM is detected on the scanned OS or via `--distro ubuntu:XX.YY+esm`. This consumes the `ubuntu:XX.YY+esm` records the ubuntu vunnel provider now emits. No DB schema change: the `os` transformer already splits the channel suffix, same as RHEL EUS. Note: the Pro/ESM detection this relies on lives in syft (anchore/syft#5028). The `syft` dependency here is temporarily pinned to that PR's branch, not a released version, and needs re-pinning once #5028 merges. FIPS / Realtime / BlueField Pro tiers are intentionally out of scope for now. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman
changed the title
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman
force-pushed
the
add-esm-support
branch
from
a158b36 to
c26037a
Compare
Signed-off-by: Keith Zantow <kzantow@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Handles Ubuntu ESM as a distro
esmchannel, modeled on the existing RHEL EUS support. When a scanned Ubuntu image is Pro/ESM-enabled, a two-pass match resolves base disclosures against the ESM-channel fixes, so users seefixed in ...+esm1instead of a bare wont-fix. Non-Pro scans are unchanged: the same CVEs still show as vulnerable/wont-fix.Off by default. Turns on when ESM is detected on the scanned OS or via
--distro ubuntu:XX.YY+esm.This consumes the
ubuntu:XX.YY+esmrecords the ubuntu vunnel provider now emits. No DB schema change: theostransformer already splits the channel suffix, same as RHEL EUS.Closes #3544
Note
FIPS / Realtime / BlueField Pro tiers are intentionally out of scope for now.