anchore / grype

A vulnerability scanner for container images and filesystems
Apache License 2.0
8.7k stars 569 forks source link

Search for distro namespaces with incomplete information #2226

Closed wagoodman closed 1 day ago

wagoodman commented 1 day ago

Fixes #2222

Today when specifying --distro you need to provide exactly the correct version information. This is not great since some distros track based on major version only and others with major.minor. This PR changes this behavior by searching for the closest matching namespace based on the provided distro information. So if the user provides --distro alpine:3.20 then we'll correctly line this up with the alpine:3.20 namespace (where as today this will match against edge).

This same loosening of namespace searching based on arbitrary version info has been applied to all distros/namespaces within the v5 schema only.