anchore / anchore/syft

Accept user-provided distro hints

Open
#736 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

_From a recent community meeting conversion on 23 Dec 2021_

**What would you like to be added**:
Provide the ability to add hints at what the linux distro is, either via CLI or application configuration:
```
SYFT_DISTRO_HINT=my-fedora-flavor syft myimage:latest

syft myimage:latest --distro-hint my-fedora-flavor
```

**Why is this needed**:
In cases where the distro is non-standard or doesn't have enough environment information, the distro info could be blank. This leads to bad matching in grype downstream when a DPKG package doesn't have enough information to tell which OS vulnerability source it should be matching against.

**Additional context**:
It may be that removing strong distro typing in syft helps with this some (https://github.com/anchore/syft/issues/342) but it isn't clear what to do when the provided hint can't be linked to a particular ecosystem. That is, should the hint apply to DPKG packages, RPM packages, all OS packages?

Contributor guide

Open the contributing guide

Research direction

The issue names no files or tests; start by tracing the CLI and application-configuration entry points that determine distro information. Resolve whether a hint applies to DPKG, RPM, or all OS packages and how an unrecognized hint behaves. Done means the chosen behavior is implemented for the environment variable and CLI flag and documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.