Closed bainsy88 closed 1 month ago
It looks like Alien::Build
has a vcpkg
database they use in tests. It seems like vcpkg
used to use a Debian-like "control" format.
This should be fixed with the indicated commit. A clair nightly built after today should have it, if you happen to have some spare time to set up a new instance and check your image.
We have seen a debian image where trying to get a report causes it to fail with
error: upstream_version is empty
Error comes from this library - https://github.com/knqyf263/go-deb-version/blob/master/version.go#L94
Which is called from here https://github.com/quay/claircore/blob/v1.5.26/debian/matcher.go#L48
Having pulled the index report for the image that sees this error we can see the follow invalid package:
The first thing that jumps out is the invalid arch for debian and the lack of version and if you look up the details for the ID you can see
Researching Alien-Build it looks like a tool for generating Perl CPAN for things that are not perl. It appears that Perl CPANfiles are the same format as a Ruby Gem which is supported by Clair so suspect that is how they are parsed but are not 100% sure.
Would be interested on thoughts around if there is a more graceful failure mode, could the image be returned as unsupported or maybe there is way to handle this scenario and still give a result?