google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev
https://google.github.io/osv-scanner/
Apache License 2.0
6.01k stars 337 forks source link

Package tracing PoC #1049

Open another-rex opened 1 week ago

another-rex commented 1 week ago

Package/vulnerability tracing capability, used to determine which layer introduced a vulnerability.

This required some minor refactoring of the experimental image scanning types.

TODOs:

codecov-commenter commented 2 days ago

Codecov Report

Attention: Patch coverage is 82.12291% with 32 lines in your changes missing coverage. Please review.

Project coverage is 65.47%. Comparing base (e619fcc) to head (992687f). Report is 1 commits behind head on main.

Files Patch % Lines
internal/image/image.go 73.77% 15 Missing and 1 partial :warning:
internal/image/scan.go 85.71% 7 Missing and 3 partials :warning:
internal/image/extractor.go 70.00% 2 Missing and 1 partial :warning:
internal/image/layer.go 89.28% 2 Missing and 1 partial :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #1049 +/- ## ========================================== + Coverage 65.32% 65.47% +0.15% ========================================== Files 150 150 Lines 12529 12636 +107 ========================================== + Hits 8184 8274 +90 - Misses 3884 3897 +13 - Partials 461 465 +4 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.