Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy #3324

Open
westonsteimel opened this issue Oct 14, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@westonsteimel
Copy link
Contributor

westonsteimel commented Oct 14, 2024

What would you like to be added:

With the recent introduction of raising up unknowns in the SBOM along with a compliance policy for determining how the unknown components should be represented, I think it would be good to treat go binaries with a value of (devel) in the same way as unknown versions for all other ecosystems.

Why is this needed:

To unify the treatment of unknown values across all ecosystems.

Additional context:
This would likely be coupled with related changes on the grype side most of which is discussed in https://anchorecommunity.discourse.group/t/grype-reporting-vulns-for-unknown-versions/174/7

@westonsteimel westonsteimel added the enhancement New feature or request label Oct 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
Status: No status
Development

No branches or pull requests

1 participant