aboutcode-org / aboutcode-org/vulnerablecode
Usability feedback on multiple `packages` returned for a single package_url
- 主要语言
- Python
- 星标
- 702
- 派生
- 328
- 平均合并
- 3 天 8 小时
- 30 天内合并 PR
- 3
描述
During a scan, a package with the following purl: `pkg:alpine/libxml2@2.9.8-r1?arch=x86_64` was discovered.
Doing a lookup on the VulnerableCode API for the `pkg:alpine/libxml2@2.9.8-r1` purl returns 10 packages:
```
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=edge&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.10&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.11&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.12&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.13&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.14&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.15&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.16&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.5&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.6&reponame=main
```
All those packages seem to share the same vulnerability data:
```
for package in data:
print([vulnerability["vulnerability_id"] for vulnerability in package["fixing_vulnerabilities"]])
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
```
From the data consumer perspective, what should be the approach to deal with all the duplicated data?
Is there a reason to capture, store, and return all those variations of the same package when the vulnerabilities are identical?
贡献指南
这个仓库没有索引到贡献指南
评估
这个 Issue 还没有评估数据。