quay / clair

Vulnerability Static Analysis for Containers

Home Page:https://quay.github.io/clair/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Unable to start with docker-compose on release-4.0

ProductiveAsparagus56 opened this issue · comments

Description of Problem / Feature Request

I followed the documentation here: https://quay.github.io/clair/howto/testing.html
but get an error (later described) when it starts, now i switch to the branch release-4.0 for stability, but get the same error.

Expected Outcome

Everything running with docker-compose

Actual Outcome

clair-database and clair-traefik running fine, but here are the error logs for clair-matcher and clair-indexer.

clair-indexer   | go: inconsistent vendoring in /src:
clair-indexer   | 	github.com/go-stomp/stomp@v2.0.8+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/google/go-cmp@v0.5.7: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/google/go-containerregistry@v0.6.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/google/uuid@v1.2.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/pgconn@v1.10.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/pgx/v4@v4.13.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/klauspost/compress@v1.13.6: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/ldelossa/responserecorder@v1.0.2-0.20210711162258-40bec93a9325: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/prometheus/client_golang@v1.12.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/quay/clair/config@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/quay/claircore@v1.4.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/quay/zlog@v1.1.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/remind101/migrate@v0.0.0-20170729031349-52c1edff7319: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/rs/zerolog@v1.26.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/streadway/amqp@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/tomnomnom/linkheader@v0.0.0-20180905144013-02ca5825eb80: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/ugorji/go/codec@v1.2.7: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/urfave/cli/v2@v2.3.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.29.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/otel@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/otel/exporters/jaeger@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/otel/sdk@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/otel/trace@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/net@v0.0.0-20220526153639-5463443f8c37: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/sync@v0.0.0-20220513210516-0976fa681c29: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/time@v0.0.0-20220411224347-583f2d630306: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	gopkg.in/square/go-jose.v2@v2.5.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	gopkg.in/yaml.v3@v3.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/aquasecurity/go-pep440-version@v0.0.0-20210121094942-22b2f8951d46: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/aquasecurity/go-version@v0.0.0-20210121072130-637058cfe492: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/beorn7/perks@v1.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/cespare/xxhash/v2@v2.1.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/cpuguy83/go-md2man/v2@v2.0.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/docker/cli@v20.10.16+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/docker/distribution@v2.7.1+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/docker/docker@v20.10.16+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/docker/docker-credential-helpers@v0.6.4: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/doug-martin/goqu/v8@v8.6.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/felixge/httpsnoop@v1.0.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/go-logr/logr@v1.2.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/go-logr/stdr@v1.2.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/golang/mock@v1.6.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/golang/protobuf@v1.5.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/chunkreader/v2@v2.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/pgio@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/pgpassfile@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/pgproto3/v2@v2.1.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/pgservicefile@v0.0.0-20200714003250-2b9c44734f2b: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/pgtype@v1.8.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/jackc/puddle@v1.1.4: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/knqyf263/go-apk-version@v0.0.0-20200609155635-041fdbb8563f: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/knqyf263/go-deb-version@v0.0.0-20190517075300-09fca494f03d: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/knqyf263/go-rpm-version@v0.0.0-20170716094938-74609b86c936: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/mattn/go-sqlite3@v1.11.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/matttproud/golang_protobuf_extensions@v1.0.2-0.20181231171920-c182affec369: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/opencontainers/go-digest@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/opencontainers/image-spec@v1.0.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/pkg/errors@v0.9.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/prometheus/client_model@v0.2.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/prometheus/common@v0.32.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/prometheus/procfs@v0.7.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/quay/alas@v1.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/quay/goval-parser@v0.8.6: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/russross/blackfriday/v2@v2.1.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/sirupsen/logrus@v1.8.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/ulikunitz/xz@v0.5.10: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/otel/internal/metric@v0.27.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	go.opentelemetry.io/otel/metric@v0.27.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/mod@v0.6.0-dev.0.20220106191415-9b9b3d81d5e3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/sys@v0.0.0-20220520151302-bc2c85ada10a: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/text@v0.3.7: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/tools@v0.1.10: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	golang.org/x/xerrors@v0.0.0-20220517211312-f3a8303e98df: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	google.golang.org/protobuf@v1.26.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-indexer   | 	github.com/quay/clair/config: is replaced in go.mod, but not marked as replaced in vendor/modules.txt
clair-indexer   | 
clair-indexer   | 	To ignore the vendor directory, use -mod=readonly or -mod=mod.
clair-indexer   | 	To sync the vendor directory, run:
clair-indexer   | 		go mod vendor
clair-matcher   | go: inconsistent vendoring in /src:
clair-matcher   | 	github.com/go-stomp/stomp@v2.0.8+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/google/go-cmp@v0.5.7: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/google/go-containerregistry@v0.6.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/google/uuid@v1.2.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/pgconn@v1.10.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/pgx/v4@v4.13.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/klauspost/compress@v1.13.6: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/ldelossa/responserecorder@v1.0.2-0.20210711162258-40bec93a9325: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/prometheus/client_golang@v1.12.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/quay/clair/config@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/quay/claircore@v1.4.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/quay/zlog@v1.1.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/remind101/migrate@v0.0.0-20170729031349-52c1edff7319: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/rs/zerolog@v1.26.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/streadway/amqp@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/tomnomnom/linkheader@v0.0.0-20180905144013-02ca5825eb80: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/ugorji/go/codec@v1.2.7: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/urfave/cli/v2@v2.3.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.29.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/otel@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/otel/exporters/jaeger@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/otel/sdk@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/otel/trace@v1.4.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/net@v0.0.0-20220526153639-5463443f8c37: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/sync@v0.0.0-20220513210516-0976fa681c29: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/time@v0.0.0-20220411224347-583f2d630306: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	gopkg.in/square/go-jose.v2@v2.5.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	gopkg.in/yaml.v3@v3.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/aquasecurity/go-pep440-version@v0.0.0-20210121094942-22b2f8951d46: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/aquasecurity/go-version@v0.0.0-20210121072130-637058cfe492: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/beorn7/perks@v1.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/cespare/xxhash/v2@v2.1.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/cpuguy83/go-md2man/v2@v2.0.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/docker/cli@v20.10.16+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/docker/distribution@v2.7.1+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/docker/docker@v20.10.16+incompatible: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/docker/docker-credential-helpers@v0.6.4: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/doug-martin/goqu/v8@v8.6.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/felixge/httpsnoop@v1.0.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/go-logr/logr@v1.2.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/go-logr/stdr@v1.2.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/golang/mock@v1.6.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/golang/protobuf@v1.5.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/chunkreader/v2@v2.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/pgio@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/pgpassfile@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/pgproto3/v2@v2.1.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/pgservicefile@v0.0.0-20200714003250-2b9c44734f2b: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/pgtype@v1.8.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/jackc/puddle@v1.1.4: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/knqyf263/go-apk-version@v0.0.0-20200609155635-041fdbb8563f: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/knqyf263/go-deb-version@v0.0.0-20190517075300-09fca494f03d: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/knqyf263/go-rpm-version@v0.0.0-20170716094938-74609b86c936: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/mattn/go-sqlite3@v1.11.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/matttproud/golang_protobuf_extensions@v1.0.2-0.20181231171920-c182affec369: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/opencontainers/go-digest@v1.0.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/opencontainers/image-spec@v1.0.2: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/pkg/errors@v0.9.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/prometheus/client_model@v0.2.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/prometheus/common@v0.32.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/prometheus/procfs@v0.7.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/quay/alas@v1.0.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/quay/goval-parser@v0.8.6: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/russross/blackfriday/v2@v2.1.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/sirupsen/logrus@v1.8.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/ulikunitz/xz@v0.5.10: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/otel/internal/metric@v0.27.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	go.opentelemetry.io/otel/metric@v0.27.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/mod@v0.6.0-dev.0.20220106191415-9b9b3d81d5e3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/sys@v0.0.0-20220520151302-bc2c85ada10a: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/text@v0.3.7: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/tools@v0.1.10: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	golang.org/x/xerrors@v0.0.0-20220517211312-f3a8303e98df: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	google.golang.org/protobuf@v1.26.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
clair-matcher   | 	github.com/quay/clair/config: is replaced in go.mod, but not marked as replaced in vendor/modules.txt
clair-matcher   | 
clair-matcher   | 	To ignore the vendor directory, use -mod=readonly or -mod=mod.
clair-matcher   | 	To sync the vendor directory, run:
clair-matcher   | 		go mod vendor

Environment

  • Clair version/image: latest or release-4.0
  • Clair client name/version: ?
  • Host OS: debian
  • Kernel (e.g. uname -a): 5.16.0-0.bpo.4-amd64
  • Kubernetes version (use kubectl version): N/A
  • Network/Firewall setup: iptables?

You need to run go mod vendor and then recreate the containers.

If you want to use the release-4.0 branch for some reason, you'll need to use the documentation on that branch, as it's different from the current instructions on main.

Shouldn't this be documented? I followed this https://quay.github.io/clair/howto/testing.html#starting-a-cluster and i don't see it anywhere in there.

Ah, this is misbehaving because of the -mod=vendor argument in the docker-compose.yaml. That shouldn't be needed anymore, I think I left it in accidentally while reworking the compose setup. Thanks for flagging that.