Skip to content

Latest commit

 

History

History
1774 lines (1673 loc) · 115 KB

CHANGELOG.md

File metadata and controls

1774 lines (1673 loc) · 115 KB
Raw

Unreleased

v1.4.11 - 2022-10-26

Build(Deps)

  • 9fdb583: bump github.com/prometheus/client_model from 0.2.0 to 0.3.0

Jar

  • d52a304: handle manifest with invalid header keys

Tarfs

v1.4.10 - 2022-10-25

Build(Deps)

  • 713df2f: bump golang.org/x/tools from 0.1.12 to 0.2.0
  • 11e9a0f: bump peaceiris/actions-gh-pages from 3.8.0 to 3.9.0
  • d94e1e7: bump gsactions/commit-message-checker from 1 to 2
  • 786ba1e: bump peter-evans/create-pull-request from 4.1.3 to 4.2.0

Chore

Fetcher

  • 4d50715: Add layer hash to error message

v1.4.9 - 2022-10-24

Build(Deps)

  • 401b227: bump golang.org/x/text from 0.3.8 to 0.4.0
  • e63deae: bump peter-evans/create-pull-request from 4.1.2 to 4.1.3
  • e7ecd78: bump actions/cache from 3.0.8 to 3.0.11

Chore

Cicd

  • 0dfcd3c: move to redhat-actions actions for golang image
  • 9a3ab55: enable dependabot for go modules

Ndb

  • 5f049d5: add package to read RPM ndb databases

Notifier

  • d9abe3d: delete manifest_index_manifest_id_package_id_dist_id_repo_id_idx

Rpm

  • 7e5d7d6: add ndb support
  • a54ea6f: split RPM header parsing into dedicated package

Sqlite

  • c160060: remove header parser, port to common API

Tarfs

  • 8a0cb12: handle data and EOF return

v1.4.8 - 2022-10-11

Chore

Tarfs

v1.4.7 - 2022-10-07

Build(Deps)

  • d4e524e: bump actions/cache from 3.0.7 to 3.0.8
  • de1fa2f: bump peter-evans/create-pull-request from 4.1.1 to 4.1.2
  • 85562c9: bump peter-evans/create-pull-request from 4.0.4 to 4.1.1

Chore

Chore

  • ffb3960: Bump goval-parser to v0.8.8

Rhel

  • 0f2066a: handle malformed build metadata

Tarfs

  • 6fb6ef5: handle tars without trailer

v1.4.6 - 2022-08-17

Build(Deps)

  • b38dc01: bump actions/cache from 3.0.5 to 3.0.7

Chore

Fetcher

  • f11ec59: Wrap error to surface type to external caller

v1.4.5 - 2022-08-01

All

Aws

  • d7edab9: remove updater integration tests

Bisect

  • e3a85e5: port to this weird test setup

Build(Deps)

  • 8f0d7d9: bump actions/cache from 3.0.4 to 3.0.5

Chore

  • 8e1cd78: Add filter version flag to release workflow
  • d69b464: v1.4.5 changelog bump
  • 24dd7e9: Add tag pattern to chg-log Changelog generator

Cicd

  • 49616bd: ensure rpm is installed for periodic tests

Cmd

  • c55fcd6: remove obsolete commands

Debian

  • d44da96: create distributions dynamically

Defaults

Docs

  • b4e2243: remove mentions of cctool

Events

  • bd0c417: facade for diagnostic events

Fetch

  • a91e041: add support for registry.access.redhat.com
  • 846553c: add options to Layer function

Integration

Libindex

  • 8cf4455: use new String method
  • f84baf4: attempt to validate tar during fetch

Libvuln

  • dadef07: fix compilation error
  • b2e2753: don't attempt to decompress within OfflineImport

Makefile

Ovaldebug

Ovalutil

Periodic

Photon

  • 34595f2: remove updater integration tests

Postgres

  • e452f64: use bisect tool to generate test fixtures
  • 9d7d063: Observe metric

Rpm

Rpmtest

  • 018e872: helpers and data structures for testing RPM indexing

Sqlite

  • e16880f: add sqlite RPM database parser

Suse

  • 6e16f47: remove updater integration tests

Tarfs

  • 5695866: add dedicated format error

Ubuntu

Updater

  • 97420ed: dedicated Updater subsystem

v1.4.4 - 2022-07-05

Chore

Updates

v1.4.3 - 2022-06-29

Alpine

  • 9db8b16: move to dynamic distributions
  • c804ced: syntax simplifications in tests
  • bf21d03: add documentation to Matcher type
  • cef8829: remove disused method

Build(Deps)

  • 7c33022: bump actions/cache from 3.0.3 to 3.0.4

Chore

Defaults

Dpkg

  • d475a7a: test with known-problematic status file

Ovalutil

  • e8478a4: sanity-check incoming dpkg version strings

Periodic

Rhel

  • 98b6183: recognize RHEL9 for updaters
  • 2eba2c4: construct distributions dynamically
  • c959ca5: test structure simplifications

Tarfs

  • 4d1ba0d: resolve symlinks when adding new files

Ubuntu

Updates

  • 0dad974: Record in a new table each time updaters check for vulns (#558)

v1.4.2 - 2022-06-09

Chore

Crda

Rhcc

  • 4059faf: don't fatally error on unexpected Dockerfiles
  • de0aac8: Update vulnerability details to match rhel patched

v1.4.1 - 2022-06-06

Build(Deps)

  • 7200c3c: bump actions/cache from 3.0.2 to 3.0.3
  • b0664a1: bump peter-evans/create-pull-request from 4.0.3 to 4.0.4

Chore

Crda

  • c854b78: check response status code

Ovalutil

Postgres

Tarfs

  • d58afbd: always create a root directory

v1.4.0 - 2022-05-24

Alpine

Build(Deps)

  • dd3b32c: bump docker/build-push-action from 2 to 3
  • 3af44fd: bump docker/setup-buildx-action from 1 to 2
  • 3b83f2e: bump docker/login-action from 1 to 2
  • 3a4c69b: bump peter-evans/create-pull-request from 4.0.2 to 4.0.3
  • 8901d07: bump actions/cache from 3.0.1 to 3.0.2
  • efa8e87: bump peter-evans/create-pull-request from 4.0.1 to 4.0.2
  • 93d74a6: bump peter-evans/create-pull-request from 3.14.0 to 4.0.1
  • 2df3f9f: bump actions/cache from 2 to 3.0.1

Chore

Claircore

  • 635aab5: use tarfs and expand Reader return

Contrib

  • 8072112: Add Release Alpine 3.16 Alpine 3.16 is not supported yet

Defaults

Dockerfile

  • 6d3940b: add quay dockerfile tests

Dpkg

Go.Mod

  • c28a174: update minimum go version

Indexer

  • 5994349: fix indexer deduplication

Java

Libindex

Libvuln

  • 6243056: fix pool DSN parameter handling

Matcher

  • 4590fd6: fail vuln report on matcher error

Osrelease

Osv

Periodic

  • 2f7d621: add package for periodic tests

Pkgconfig

Postgres

  • 4655883: update metrics on GetEnrichment

Python

Rhcc

  • 839adc6: add machinery for the Red Hat Container Catalog

Rhctag

  • aaa4de6: add package for Red Hat Container versions

Rhel

  • c38558a: normalize serverity to all-lower strings
  • 8f021ab: use tarfs in scanner

Rpm

Tarfs

  • 361a2ca: package for implementing fs.FS over a tar

Ubuntu

v1.3.2 - 2022-03-21

Alpine

  • 051b3c7: Ignore any vulns that have 0 as the fixed_in_version (#581)
  • 99dec48: check validator on 200 response

Build(Deps)

  • 171469d: bump peter-evans/create-pull-request from 3.12.1 to 3.14.0
  • 907037e: bump actions/checkout from 2 to 3

Chore

Ci

  • 12fa580: remember to log into quay.io
  • 353e1f9: don't fail job when there's nothing to do
  • f48ae57: fix version checker script
  • 55db234: update main ci workflow
  • cab09db: update base image builder machinery

Crda

Cvss

Debian

  • 3a7988d: check validator on 200 response

Dockerfile

  • 0dcf0c7: support invalid label syntax

Etc

  • 02ca493: update Dockerfile and Makefile

Jar

  • e5bb400: use textproto in place of mail

Ovalutil

  • 00acbb5: check validator on 200 response

Pyupio

  • cd8aa81: check validator on 200 response

Rhel

  • 243f329: check validator on 200 response

Ubuntu

  • c8ee8b9: check validator on 200 response

v1.3.1 - 2022-02-21

Chore

Enrichment

v1.3.0 - 2022-02-16

All

Build(Deps)

  • 8f79866: bump peter-evans/create-pull-request from 3.12.0 to 3.12.1

Chore

Controller

Crda

Debian

Docs

  • 33c7142: fix test in compiled docs
  • 20c31c9: update README
  • 8cfac96: add test for linked pages
  • 4d8902a: update any code or documentation samples

Fastesturl

Go.Mod

Integration

  • b533b20: move code snippets to examples

Layerscanner

Libindex

  • 168989d: fix integration test
  • df1115a: add pgxpool metrics
  • b2eca12: fix file access race
  • 34a38fd: treat ConnString same as libvuln
  • 2176bcc: add example from README
  • ea826b7: remove requirement on Opts.ConnString

Libvuln

  • edafd21: fix leaked lock manager
  • 2f312f0: add pgxpool metrics
  • 6b82f45: add example from README
  • 2ec1818: remove requirement on Opts.ConnString

Mock/Driver

  • a969bc1: move Matcher mock to dedicated package

Mock/Indexer

  • 305da17: use dedicated mocks package
  • d305501: move indexer mocks to dedicated package

Mock/Vulnstore

  • 61c2335: move Store mock to dedicated package

Poolstats

  • a1eaf2c: add package for collecting pgx pool stats

Rhel

v1.2.0 - 2022-01-14

Build(Deps)

  • 9fbff76: bump peter-evans/create-pull-request from 3.11.0 to 3.12.0

Chore

Dockerfile

GC

Go.Mod

  • 2aac174: update minimum go version

Jar

Libindex

  • f53a08f: set postgres application name
  • d390f79: expose DeleteManifests method

Libvuln

  • 58abf35: set postgres application name
  • 5b95f97: print documentation links with matcher names

Migrations

  • 08db7b9: add foreign key cascade constraints

Postgres

v1.1.6 - 2021-12-07

Chore

Dockerfile

Ubuntu

v1.1.5 - 2021-12-07

Chore

Crda

v1.1.4 - 2021-12-07

Alpine

Aws

Chore

Debian

Jar

Java

Libvuln

Oracle

Pep440

Photon

Rhel

Suse

Ubuntu

Xmlutil

  • a27a18b: add package for XML helpers

v1.1.3 - 2021-11-19

Chore

Cpe

Dockerfile

Jar

  • c37acbc: handle archives with invalid filesystem semantics

Test

v1.1.2 - 2021-11-05

Build(Deps)

  • c81b37a: bump peaceiris/actions-gh-pages from 2 to 3.8.0
  • a401058: bump peter-evans/create-pull-request from 3.5.1 to 3.11.0

Chore

Cicd

  • fa1f877: switch gh-pages action to use default token
  • 44bbd6a: update documentation arguments
  • 1a85242: fix changelog template
  • 752df85: update release workflows for branch, tag changes

Crda

  • 8d90253: simplifications, formatting, and typos
  • edd435b: update defaults
  • 659db9f: updated remote-matcher
  • f319d74: revert "crda: remove matcher"

Dockerfile

  • e0a2bac: fix terminal expansion with too-small destination

v1.1.1 - 2021-10-28

Chore

Cicd

  • 3e7043f: add caches for testdata, modules, and builds

Debian

Dockerfile

  • b658fdf: add a low-dependency Dockerfile parser

Dpkg

  • c8a6e7f: test status file directly
  • 0977b3e: remove bufio.Scanner usage

Jar

  • eb85f0b: parse any archive in test
  • 846c076: handle manifests with multiple sections
  • f33c1fc: add Parse test to help debugging

Java

  • 43703c7: properly handle embedded jars
  • b44ca85: don't error for known classes of failures

Rhel

Ubuntu

v1.1.0 - 2021-09-28

v1.1.0-rc.1 - 2021-09-28

Alpine

Gc

  • 056d5e7: add foreign key ON DELETE CASCADES to uo_enrich table (#470)

Jar

Java

  • 2b9423d: move to internal jar package

Libindex

  • c0a71c6: recognize application/x-gzip content-type
  • 4836df6: new fetcher implementation

Rpm

  • 691f202: prevent directory traversal when extracting
  • dab4e19: examine file for BDB magic numbers
  • 64f6249: handle cross-layer hardlinks when extracting

v1.1.0-rc.0 - 2021-09-02

Build(Deps)

  • 8ba0561: bump github.com/ulikunitz/xz from 0.5.7 to 0.5.8

Cctool

Chore

Cicd

  • 4647949: release golang Docker image for linux/arm64

Controller

Ctxlock

Debian

Distlock

Dpkg

Fetcher

Indexer

Integration

Java

Layerscanner

  • a2899c5: log returned errors with scanner

Libindex

  • 9115ee0: use new controller and ctxlock APIs

Libvuln

Postgres

  • fa7d23e: update gc test
  • b68fdf8: add timeouts around database operations
  • 9217a95: use wrap formatting verb

Rhel

Rpm

Scripts

  • 0d7ac64: check in a prepare-release script

Updates

  • 896fd8a: remove distlock-like API

Vulnstore

v0.5.5 - 2021-09-28

Chore

Gc

Rpm

v0.5.4 - 2021-08-17

Chore

Rpm

v0.5.3 - 2021-08-16

Chore

Java

Rpm

v0.5.2 - 2021-08-10

Chore

Rpm

  • cca9933: special-case symlinks
  • 3060f8b: eagerly change directory permissions

v0.5.1 - 2021-07-27

Chore

Integration

v0.5.0 - 2021-07-15

All

  • 67c0791: use GOMAXPROCS instead of NumCPU
  • f7b23aa: switch CODEOWNERS to use clair team
  • 6bd0386: remove jzelinskie from CODEOWNERS

Chore

Claircore

  • 68e107a: add Enrichments to VulnerabilityReport

Crda

Cvss

Defaults

Dpkg

Driver

  • ed3a555: add enrichment types and interfaces

Fetcher

  • 2f1b61d: include response body in error message for non-200 repsonses

Indexer

  • f36da9f: avoid creating a new db pool for the locks

Integration

Introspection

  • 3f72eb7: add scanned_before metrics

Java

Jsonblob

  • dbd56bb: implement enricher methods

Libindex

  • 526e1ba: use new DB testing harness
  • d7cea80: fix manifest_index unique constraint

Libvuln

  • 391adac: add Enrichment API surface

Makefile

  • 2a3634d: update in light of test DB changes

Matcher

Postgres

  • dbaa2f7: fix query in GetLatestUpdateRefs
  • 0db5101: implement enricher methods
  • 7b4475f: use new DB testing harness
  • e364e13: use new DB testing harness

Rhel

  • 80a2826: use new DB testing harness

Updater

Updates

Vulnstore

  • bec40e2: add enrichment interfaces

v0.4.8 - 2021-09-28

Chore

Gc

Rpm

v0.4.7 - 2021-08-17

Chore

Rpm

v0.4.6 - 2021-08-16

Chore

Java

Rpm

v0.4.5 - 2021-08-10

Chore

Rpm

v0.4.4 - 2021-08-06

Chore

Indexer

  • 302384b: avoid creating a new db pool for the locks

Rpm

  • 9b1d1e3: eagerly change directory permissions

v0.4.3 - 2021-06-15

Chore

Crda

Dpkg

Libindex

  • c809930: fix manifest_index unique constraint

v0.4.2 - 2021-05-11

Alpine

  • f92e1be: implement driver.Configurable

Aws

  • 4738610: add http.Client configurability

Chore

Cicd

  • fe6cb92: use golang major version tag for dev env
  • 0a04053: use quay.io/projectquay/golang image
  • d62b5ad: add golang-image workflow

Crda

  • 5146d8c: implement driver.MatcherConfigurable

Debian

  • 3d2d700: implement driver.Configurable

Enrichments

Fetcher

  • cd6b7fa: remove DefaultClient usage

Jsonblob

Libindex

  • eec427f: use configurable http.Client

Libvuln

  • 34de61e: add warn logs when not providing an http.Client

Libvulnhttp

  • ef4ee5c: add HTTP client debugging flag

Matchers

Oracle

  • de18d67: add assertion for Configurable interface

Ovalutil

  • d3106a3: implement driver.Configurable

Photon

  • 28341b9: add assertion for Configurable interface

Pyupio

  • 2cf6a9e: implement driver.Configurable

Registry

Rhel

  • 5c873b4: add assertion for Configurable interface
  • 2112153: pass Client through Factory
  • ad16c39: make repo2cpe mapping a work stealing scheme

Suse

  • 0039063: add assertion for Configurable interface

Ubuntu

  • 2976e93: implement driver.Configurable

Updater

  • 9145453: report error on nil *http.Client
  • ece3005: call Configure method if present

Updates

  • 59bec1f: call Configure method if present
  • de4be78: drop updater when configuration fails
  • 9bc81ca: consolidate update logic
  • 9ade4e1: add LockSource interface

Vulnstore

  • e9cd964: fix getting update operation diff
  • bfafd2f: enrichment migration

v0.4.1 - 2021-05-04

All

  • def957b: return empty byte slices from MarshalText

Chore

Cicd

Crda

  • 1405b57: use bulk API in remotematcher

Indexer

  • 905d6f3: Implement package indexer for maven

Introspection

  • 9ecfbb0: Fix a typo in the query label for the distributionbylayer metric

Libindex

  • 5877dc1: set concurrency number
  • 254c094: AffectedManifests to be bounded

Matcher

  • 78f069b: add ability to return multiple matchers from same type

Testing

v0.4.0 - 2021-04-05

Chore

Cicd

  • ab1208b: update doc building to main

Docs

  • 99d6eff: note default updater URLs

Introspection

Python

  • 24aad97: force re-fetch/parse
  • 1f881b5: update package scanner version

Rhel

  • 8cc2823: discard unaffected vulnerabilities
  • ddd2621: treat vulns without FixedInVersion as unfixed

v0.3.3 - 2021-03-18

Chore

Cicd

v0.3.2 - 2021-03-18

Chore

  • 280bf2b: v0.3.2 changelog bump
  • d3ac00e: release quay.io/claircore/golang:1.16
  • bfb37f0: update comments in distribution scanners

Cicd

  • 7d55319: sort changelog by semver
  • eae2b15: bump out go1.14 and bump in go1.16
  • d9f28c4: gh action echo branch
  • 6efb496: fix gh action script
  • 67fa955: filter tags for stable branch releases

Fetcher

Fix

  • 892ba0c: comments and docs
  • 7b054c2: provide a way for default and out-of-tree matchers

Indexer

Libindex

Matcherfactory

Matchers

Python

  • 2cef538: move to traditional mapping

Rhel

  • 5eba440: fix cpe mapping type assertion

Vulnstore

v0.3.1 - 2021-02-11

Chore

Libindex

  • 2cf7d4a: limit MaxConns in controller pool to 1

v0.3.0 - 2021-02-05

Chore

Cicd

Docs

Libvuln

Remotematcher

  • b95d984: Implement RemoteMatcher for CRDA

Severity-Mapping

Updates

Vulnstore

v0.2.0 - 2021-01-19

All

Alpine

Aws

Cctool

Chore

Cicd

  • e749f3b: drop go1.13 support
  • 733d8f1: use quay.io/claircore/golang in CI

Claircore

Controller

Debian

Fastesturl

  • cd55757: use Cleanup method in tests

Fetch

  • 5ac709b: turn layer fetcher into a generic fetcher

Go.Mod

  • eed4aaa: remove testify dependency

Go.Sum

Indexer

  • 313c8c4: filter scanners during manifest check

Layerscanner

Libindex

Libvulnhttp

  • f31eec7: add DisableBackgroundUpdates config option

Linux

Misc

Photon

Postgres

Rhel

Updaters

Vulnstore

v0.1.26 - 2021-06-15

Chore

Cicd

Dpkg

Libindex

  • a217608: fix manifest_index unique constraint

Vulnstore

v0.1.25 - 2021-04-16

Chore

Cicd

  • 9ba3cdc: use git-chglog fork to sort by semver
  • aaab793: sort changelog by semver

Indexer

  • ed50b6a: filter scanners during manifest check

v0.1.24 - 2021-03-25

Chore

Libvuln

  • 0823927: sync migrations with upstream

Python

v0.1.23 - 2021-03-11

Chore

Cicd

  • 62575fd: bump out go1.14 and bump in go1.16

Fetcher

Indexer

Python

  • 763ccdc: move to traditional mapping

v0.1.22 - 2021-02-12

Chore

Cicd

v0.1.21 - 2021-02-12

Chore

Rhel

  • 17a73b5: fix cpe mapping type assertion

Reverts

  • cicd: use CI golang image from quay.io

v0.1.20 - 2020-12-11

Alpine

  • 98d3828: switch to JSON security DB

Chore

Cicd

  • 97fa28b: use CI golang image from quay.io

Docs

  • 00d4fcc: fix couple typos in libvuln_usage.md

Rhel

  • baff663: ignore rhel-7-alt OVAL stream

v0.1.19 - 2020-12-03

Chore

Docs

Dpkg

  • 8025828: add checks to discovered paths

Indexer

  • f493a89: utilize migration for data model refactor
  • 65aced8: e2e with multiple scanners
  • f31ca4c: database refactor

v0.1.18 - 2020-12-02

Chore

Cicd

  • e80d4c7: bump create pull request action

Oval

  • b6f61ac: rpm and dpkg parser updates

v0.1.17 - 2020-11-30

Chore

Cicd

  • efbc55b: github actions set-env fix

v0.1.16 - 2020-11-25

Chore

Documentation

  • 268b037: indexer state diagram update

Ovaldebug

  • 6986794: add tool for testing parsing of OVAL

Ovalutil

  • aa1927a: fix dpkg "name caching" bug
  • f9dea3a: update vulnerability heuristic

Ubuntu

  • 6d61f87: attempt to add normalized severity

Updater

v0.1.15 - 2020-11-02

Alpine

Chore

Etc

Matcher

  • 9b9c113: add apk specific version parser for alpine

v0.1.14 - 2020-10-26

Rpm

  • 04cb53c: fix error handling in WalkFunc

v0.1.13 - 2020-10-19

Chore

Pyupio

  • 6569e25: handle database schema change

v0.1.12 - 2020-10-19

Chore

Updaters

  • 1fd140d: do not kill loop on error

v0.1.11 - 2020-10-08

Chore

Cicd

  • 9b7d461: copy some changes from clair's CI workflows

Oval

Repo2cpe

v0.1.10 - 2020-10-01

Affected Manifests

  • f8f0ff2: Use mather's Filter() in omnimatcher
  • aebd3a8: Add missing properties into affected manifest query

Chore

Cicd

  • d118d98: force no flags for regexp commit check

Postgres

  • 2df1697: remove warning in common case

Updater

  • c6b1bc9: use pointer receiver for errmap methods

v0.1.9 - 2020-09-28

Chore

Layerscanner

  • 4a1b872: prevent misleading log line

Vulnstore

v0.1.8 - 2020-09-23

Chore

Cicd

Makefile

  • 1d9b607: handle SELinux permissions for volume in docker-compose

Rpm

  • d75ba4c: wait til command is finished
  • 3008cba: Reduce database file to Packages

v0.1.7 - 2020-09-15

Chore

RHEL

  • f4d10b5: Use last-modified to cache data

v0.1.6 - 2020-09-11

Chore

Cicd

  • ff6af2a: new release and change log process
  • 40c7a28: new release and change log process

Postgres

  • ff884b7: manage the number of update_operations

v0.1.5 - 2020-09-11

Testing

  • 40861cf: bump golang 1.15 local dev

v0.1.4 - 2020-09-10

Goval

  • 6f3dbd5: bump goval for ubuntu date fix

v0.1.3 - 2020-09-03

Coalescer

  • ee37a8f: refactor of the linux coalescer

Docs

v0.1.2 - 2020-09-02

Rhel

v0.1.1 - 2020-08-26

Cctool

Libvuln

  • 823ffdc: use updater defaults
  • c89c59a: re-add matchers that got lost somehow
  • 104c5f3: add OfflineImport function

Libvulnhttp

  • fc85f57: call new defaults register function

Updater

  • 006f540: set up an updater registry and defaults

v0.1.0 - 2020-08-11

Add

  • f31f160: Oval operation/arch matcher

Alpine

  • 736017c: use etag instead of date

Arch Op

  • 6b9c72f: turn into string, implement pattern match

Aws

Cctool

  • cd8b332: add offline update subcommands

Debian

Distlock

  • 24c305f: implement interface over pgxpool

Driver

  • 3f4d56f: add Configurable interface

Jsonblob

  • 92f3904: add database impostor package

Libvuln

  • 568096b: refactor updater execution
  • f7426b2: use new Configurable interfaces
  • b9b5dec: use Executor + UpdateSetFactory

Log

  • 900f3bb: one more attempt at race squashing

Matcher

Osrelease

Ovalutil

  • 6309553: don't record Date in fingerprint if Etag is present
  • c84d73c: use modified and etag conditional requests
  • bf06dd5: handle "exists" tests better

Postgres

  • 4e8df71: split vulnerability creation into two statements
  • 27359db: remove sqlx usage

Pyupio

Rhel

Ubuntu

Updater

  • ea1a99a: add Controller and offline implementation

v0.0.25 - 2020-06-08

Updatediffs

v0.0.24 - 2020-06-01

v0.0.23 - 2020-05-26

Aws

  • 79bad1e: ensure Close call gets to underlying File

Cpe

  • ef7ce23: use a structured type for CPEs

Etc

  • 4e73b31: podman yaml needs volume flag

Fastesturl

Indexer

  • 11b4676: add Configurable interface

Libindex

  • ac10351: use new Configurable interfaces

Ubuntu

v0.0.22 - 2020-05-01

Claircore

  • d04ad4c: make Severity a proper enum

Docs

Makefile

  • 373f1cd: use podman play for podman env

v0.0.21 - 2020-04-30

Postgres

  • 7f42a18: defer after checking error

v0.0.20 - 2020-04-17

v0.0.19 - 2020-04-03

Migrations

  • e76ed28: improve extension error reporting

v0.0.18 - 2020-03-12

Fastesturl

Integration

  • 7a30aaa: load uuid-ossp before dropping privileges

Libvuln

  • 486e6a6: use new Updater interface

Migrations

  • a6aaa82: rewrite schema to be operation-based

Pkgconfig

Postgres

  • e3fa032: implement new Updater interface

Reduce

  • 1010855: pass all instances of a layer to be fetched to the fetcher

Updater

  • 41860d4: use new Updater interface

Vulnstore

  • 3873d45: update Updater interface

v0.0.17 - 2020-03-05

v0.0.16 - 2020-02-28

Alpine

  • e800a02: don't choke on very large package entries

Cctool

  • ae4be45: dump vulnerability report with dump flag

Claircore

  • c99a5c8: add Version and Range types

Controller

  • f6587f8: record manifest before using in logger

Driver

  • e2d3d34: add optional interface for database filtering

Fetcher

  • ee72da6: handle servers returning binary/octect-stream

Indexer, Vulnstore

  • 062bf90: use version and range in the database
  • f8d17dc: database connection correctness

Libindex

Libvuln

Makefile

  • 116d63f: use variables in podman targets

Matcher

  • b72885d: use db filtering in controller

Migrations

  • a5b9f0d: add version representation to database

Pep440

  • 4436de2: add package supporting PEP-440 versioning

Python

  • 3f6abba: add python package scanner

Pyupio

Rhel

  • ad81962: check before dereferencing record.Distribution

Rpm

  • 75ef273: don't extract whiteout files

Test

  • b9c767b: add common package scanner machinery

v0.0.15 - 2020-03-03

Ovalutil

v0.0.14 - 2020-02-10

All

Cctool

  • 2b3bb44: add "manifest" subcommand

Docs

  • dbd6ba2: use mdBook config file instead of weird symlinks

Feat

  • 2030a92: add jUnit reports to cctool

Postgres

  • 1bec5c9: retrieve updater informaition

v0.0.13 - 2020-01-15

All

  • 7d6e79b: use bigserials in the database

Cctool

  • 8c1e827: update with datastructure changes and index call semantics

Libindex

Libvuln

  • 09b75dd: propagate initilization context

Makefile

Postgres

  • 932cece: remove use of context.Background
  • e453f95: discard vulnerabilites with no package
  • cbf05ac: discard empty-named packages

v0.0.12 - 2020-01-10

v0.0.11 - 2020-01-09

v0.0.10 - 2020-01-08

All

  • f7791a0: remove context.Background usage in test

Cctool

  • c7918bf: generate storage URLs based on registry manifest

Etc

Fetcher

Libindex

  • 8a5a18a: add state endpoint and merge http handler
  • 5195457: add State method

Libindexhttp

  • 38bfe2d: propigate context from main

Log

  • 8788c7d: bound log prints to a Context

Osrelease

  • bb74bc1: don't unconditionally defer

Postrges

  • 4c9b86f: fix test copy-paste errors

v0.0.9 - 2019-12-10

v0.0.8 - 2019-12-10

All

  • 57ffc13: regroup imports consistently

Cctool

  • 250d8da: add a tool for interacting with claircore directly

Claircore

  • 60789e7: add annotations to generate slighty smaller json

Libvuln

  • 9ae9ed9: add rpm matcher to defaults

Libvulnhttp

  • dff4316: wire in additional debugging logs

Makefile

  • a8bf8be: have podman remove volumes

Osrelease

Osrelease, Ovalutil

Ovalutil

  • e650898: add cpe information to packages

Postgres

  • 37fccbb: use different names for different prepared statements
  • 1e8c519: handle driver.Package(Source)Name arguments
  • 5db1ffe: check query builder error

Rhel

Rpm

  • e4cd783: prevent infinite loop on read error
  • 383e108: fix package scanner test

Test

v0.0.7 - 2019-12-02

v0.0.6 - 2019-11-27

Fetcher

  • 0c4072c: check error before defer

Rpm

v0.0.5 - 2019-11-19

v0.0.4 - 2019-11-15

All

Claircore

  • 50d7a96: bump goval-parser version

Integration

  • 01ea77c: add database test harness

Ovalutil

  • d4cc8d0: attach detected dist to vulns

Updater

v0.0.3 - 2019-10-04

Go.Mod

  • 267126b: update goval-parser version

Oracle

  • 8f38e72: rework to year-wise databases

Ovalutil

  • fa5ca19: rename oval package and add common rpminfo functions

Postgres

Suse

v0.0.2 - 2019-10-03

Amazon

Oracle

  • 7d434c4: add Oracle Linux oval updater

v0.0.1 - 2019-09-30

All

Distlock/Postgres

Driver

  • bce0ecf: create libvuln/driver package

Integration

  • ebc1eea: add test/integration package

Makefile

  • a29d899: have docker-compose populate and use a vendor directory
  • b97b97e: have podman targets populate and use a vendor directory
  • 480d4e5: add some podman

Rhel

  • 41f947f: add rhel vulnerability updater

Scanner

Updater

  • 62abdfa: don't expect to call Close on error paths

Vendor

Vulnstore

  • 4c53d16: add context.Context to interfaces

Pull Requests

  • Merge pull request #28 from quay/louis/dist-lock-fix
  • Merge pull request #27 from quay/louis/unique-constraint-fix
  • Merge pull request #9 from quay/docker-compose
  • Merge pull request #12 from quay/code-owners
  • Merge pull request #6 from quay/debian-support
  • Merge pull request #5 from quay/scanner-data-model-docs
  • Merge pull request #3 from quay/documentation