Accept user-provided distro hints
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 42
Description
_From a recent community meeting conversion on 23 Dec 2021_
**What would you like to be added**:
Provide the ability to add hints at what the linux distro is, either via CLI or application configuration:
```
SYFT_DISTRO_HINT=my-fedora-flavor syft myimage:latest
syft myimage:latest --distro-hint my-fedora-flavor
```
**Why is this needed**:
In cases where the distro is non-standard or doesn't have enough environment information, the distro info could be blank. This leads to bad matching in grype downstream when a DPKG package doesn't have enough information to tell which OS vulnerability source it should be matching against.
**Additional context**:
It may be that removing strong distro typing in syft helps with this some (https://github.com/anchore/syft/issues/342) but it isn't clear what to do when the provided hint can't be linked to a particular ecosystem. That is, should the hint apply to DPKG packages, RPM packages, all OS packages?
Contributor guide
Research direction
The issue names no files or tests; start by tracing the CLI and application-configuration entry points that determine distro information. Resolve whether a hint applies to DPKG, RPM, or all OS packages and how an unrecognized hint behaves. Done means the chosen behavior is implemented for the environment variable and CLI flag and documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100