aboutcode-org / aboutcode-org/vulnerablecode

Usability feedback on multiple `packages` returned for a single package_url

未关闭
#1,219 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
702
派生
328
平均合并
3 天 8 小时
30 天内合并 PR
3

描述

During a scan, a package with the following purl: `pkg:alpine/libxml2@2.9.8-r1?arch=x86_64` was discovered.

Doing a lookup on the VulnerableCode API for the `pkg:alpine/libxml2@2.9.8-r1` purl returns 10 packages:
```
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=edge&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.10&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.11&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.12&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.13&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.14&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.15&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.16&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.5&reponame=main
pkg:alpine/libxml2@2.9.8-r1?arch=aarch64&distroversion=v3.6&reponame=main
```

All those packages seem to share the same vulnerability data:

```
for package in data:
print([vulnerability["vulnerability_id"] for vulnerability in package["fixing_vulnerabilities"]])

['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
['VCID-9me2-5n8r-aaas', 'VCID-a5cr-256c-aaac', 'VCID-m7ct-1jfm-aaaj']
```

From the data consumer perspective, what should be the approach to deal with all the duplicated data?
Is there a reason to capture, store, and return all those variations of the same package when the vulnerabilities are identical?

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。