aboutcode-org / aboutcode-org/vulnerablecode
Usability feedback on multiple `packages` returned for a single package_url
- 主要言語
- Python
- スター
- 702
- フォーク
- 328
- 平均マージ
- 3日 8時間
- マージ済み PR（30日）
- 3
説明
During a scan, a package with the following purl: `pkg:alpine/libxml2@2.9.8-r1?arch=x86_64` was discovered.
Doing a lookup on the VulnerableCode API for the `pkg:alpine/libxml2@2.9.8-r1` purl returns 10 packages:
```
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=edge&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.10&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.11&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.12&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.13&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.14&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.15&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.16&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.5&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.6&reponame=main
```
All those packages seem to share the same vulnerability data:
```
for package in data:
print([vulnerability["vulnerability_id"] for vulnerability in package["fixing_vulnerabilities"]])
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
```
From the data consumer perspective, what should be the approach to deal with all the duplicated data?
Is there a reason to capture, store, and return all those variations of the same package when the vulnerabilities are identical?
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。