Open orlando-jamie opened 4 years ago
Sorry, I am a moron. I did not realize you could just comment with a #. I can achieve what I want with the following.
general:
# This finding represents a collection of kernel vulnerabilities. In the container world, containers share the same kernel as the host operating system, and thus, kernel vulnerabilities can not accurately be detected at the container layer. Accurate scans for this vulnerability need to occur on the docker host itself.
- RHSA-2018:1345
images:
centos:
# This finding represents vulnerabilities to the basic auth function of httpd. Since we do not use basic auth in applications using the centos container, this finding is not relevant.
- RHSA-2017:2479
# blah
- RHSA-2018:0805
alpine:
# you get the point
- CVE-2017-9671
fluent/fluent-bit:
# more
- CVE-2017-14062
# comments
- CVE-2018-6485
Hello, To appease auditor types, it would be useful to allow for comments in the whitelist.yaml file. This will allow us to version control our whitelist file, but also give some human reason for performing the whitelist. As we know, people and knowledge are lost over time, so would be nice to be able to put this information right into the whitelist file.
Suggested behavior