quay / clair

Vulnerability Static Analysis for Containers

Home Page:https://quay.github.io/clair/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Clair 4.2.0 not scanning RHEL RPMs

jasonbrianhall opened this issue · comments

It doesn't seem like Clair 4.2.0 is scanning RPMs . I scanned some of my images that were several months old and richxsl/rhel7 from docker.io and only received some pypi results and maven findings. I can see that the the database has RHEL based vulnerabilities when I query the "vuln" table but they aren't showing up when I query http://matcher:port/matcher/api/v1/vulnerability_report/imageDigest
richxsl_rhel7.json.gz

Do you have logs from the server for a run?

If you attached something to the email, it didn't make it to the github issue.
If you're referencing the upload on the initial post, that's not a log; it looks like the response to an API call.

clair.tar.gz

Attached the logs (HTML and ANSI)

From the logs and server response, it looks like the image was indexed successfully.

From the server logs, it looks like the server was stopped in the middle of fetching vulnerabilities. Please try using the latest version and letting the server finish fetching vulnerabilities.

Is this still happening on the latest release?

Closing due to age.