quay / clair

Vulnerability Static Analysis for Containers

Home Page:https://quay.github.io/clair/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Documented updated.filters feature is not implemented

klr8 opened this issue · comments

Description of Problem / Feature Request

The "Updaters and Airgap" documentation mentions a "Filtering Updaters" feature:
https://github.com/quay/clair/blob/main/Documentation/concepts/updatersandairgap.md#filtering-updaters

This feature does not seem to be implemented.
The only related thing I could find in the source code is a RegexFilter function in the updaters module:
https://github.com/quay/claircore/blob/1405b573a27c08e12d974f0f2b7f4dcf1b149183/libvuln/driver/updaterset.go#L95

But that does not seem to be used by the rest of the code.

Note that the main "Config" documentation does not mention updaters.filters:
https://github.com/quay/clair/blob/main/Documentation/reference/config.md

Expected Outcome

As documented, have an ability to filter the enabled updaters. This can help in reducing the amount of vulnerabilities that need to be downloaded: e.g. we no longer have RHEL6 and don't want to download the large amount of vulnerabilities related to that RHEL distribution.

Actual Outcome

Updater filtering is not implemented.

Environment

  • Clair version/image: 4.6.0

Yeah this should be removed from the documentation, as it's not used and implemented as a filter on updater name, which is going to be much less useful with the new updater API, which allows for handling multiple files in a way that the current system doesn't.