search

anchore / vunnel

Tool for collecting vulnerability data from various sources (used to build the grype database)
Apache License 2.0
68 stars 25 forks source link

Keep original import timestamp on results archive import #560

Closed wagoodman closed 4 months ago

wagoodman commented 4 months ago

When using the results import approach @westonsteimel noticed that the workspace metadata timestamp was being (erroneously) updated:

The hosted metadata:

{
  "provider": "amazon",
  "timestamp": "2024-04-29T13:06:00.992247+00:00",
  "stale": true,
  ...
}

After running vunnel and importing the hosted results archive:

{
  "provider": "amazon",
  "timestamp": "2024-05-01T01:30:31.951204+00:00",
  "stale": true,
  ...
}

This is because when calling provider.update() the metadata is overwritten with a new timestamp value. This PR fixes this such that the timestamp of the import is persisted/honored (instead of updating the timestamp to time-of-import).