anchore / grype

A vulnerability scanner for container images and filesystems
Apache License 2.0
8.17k stars 528 forks source link

Inconsistent naming of matchDetails.searchedBy.package field #1877

Closed andre-aktivconsultancy closed 1 month ago

andre-aktivconsultancy commented 1 month ago

What happened: I noticed that the 'package' field in matchDetails.searchedBy object sometimes starts with a capital and sometimes not.

What you expected to happen: Consistent naming.

How to reproduce it (as minimally and precisely as possible):

grype eclipse-mosquitto:2.0.18 -o json | jq '.matches[].matchDetails[] | {matcher, package: .searchedBy.package, Package: .searchedBy.Package }'

The output will sometimes show package and sometimes Package.

{
  "matcher": "apk-matcher",
  "package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": {
    "name": "openssl",
    "version": "3.1.4-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": {
    "name": "openssl",
    "version": "3.1.4-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": {
    "name": "openssl",
    "version": "3.1.4-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": {
    "name": "openssl",
    "version": "3.1.4-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  },
  "Package": null
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}
{
  "matcher": "apk-matcher",
  "package": null,
  "Package": {
    "name": "busybox",
    "version": "1.36.1-r5"
  }
}

Anything else we need to know?:

Environment:

tgerla commented 1 month ago

Hi @andre-aktivconsultancy, thank you for the report! We have reproduced this and we'll get it into the backlog for a fix.