clair

[Unreleased]

[v4.8.0] - 2024-10-09

NOTE

This release deprecates the updaters that rely on the Red Hat OVAL v2 security data in favor of the Red Hat VEX data. This change includes a database migration to delete all the vulnerabilities that originated from the OVAL v2 feeds, meaning there could be a time in production environments before the VEX updater completes for the first time when no Red Hat vulnerabilities exist. This release also contains a clairctl admin command to clean up the deprecated vulnerabilities outside of the migration workflow which allows an operator to pre-run the migration:

clairctl -D admin pre v4.8.0

Claircore

• rhel: move IgnoreUnpatched config key from updater to matcher

• rhel: add csaf/vex updater

• datastore: add vuln and enrich stream updates

• cpe: add match expression support

'Chore

• ab3a754e: update claircore to v1.5.19
• f783b356: update claircore to v1.5.18
• 9286ab86: update claircore to v1.5.17

Admin

• d3467bad: add pre v4.8.0 admin command to delete OVAL vulns
• d53780b6: add a check for compatible migration version
• 87c24a9c: add command to update go packages with norm_version
• 02e6c925: add pre v4.7.3 admin command to create index

All

• 55294aaf: fix incorrect API paths
• daa78ec2: fix some typos

Amqp

• 8fcd294c: migrate to maintained package
• #1793### Auto
• 07b0ea7b: improve log messages
• #2092### Build(Deps)
• [5092198b](https://github.com/quay/clair/commit/5092198b0459e12ec2472d

[Unreleased]

[v4.7.4] - 2024-05-01

NOTE

The default layer download location has changed

Claircore

• tarfs: follow hardlinks in ReadFile

• debian: update how "source" packages are handled

• dpkg: improve Source handling

• libindex: add O_TMPFILE fallback logic

  Please see the documentation for specifics.

  26-0.20240325212310-fedb9d327aa7#NewRemoteFetchArena

• osv: parse database_specific severity when no CVSS severity is defined

Build(Deps)

• 3ebd889c: bump peter-evans/create-pull-request from 6.0.0 to 6.0.1
• b7566a0f: bump peter-evans/create-pull-request from 5.0.2 to 6.0.0
• 4db2f09b: bump actions/cache from 3 to 4
• 6cef8311: bump actions/upload-artifact from 3 to 4
• 5ed80215: bump actions/download-artifact from 3 to 4
• c9e1f56b: bump actions/setup-go from 4 to 5
• 3ab3de55: bump actions/stale from 8 to 9
• 591188f0: bump docker/setup-buildx-action from 2 to 3
• 7ef6ef6b: bump docker/login-action from 2 to 3
• 5597e7cc: bump docker/build-push-action from 4 to 5
• 14d7f2b4: bump docker/setup-qemu-action from 2 to 3
• 1204db98: bump actions/checkout from 3 to 4

Chore

• 4170798b: 4.7.4 changelog bump
• 96dc6074: Add merge step when creating release binaries
• a1c7eb7c: update go ver

Highlights:

• The minimum TLS version is now 1.2. Previously, servers also allowed 1.1 connections.

• Claircore is updated to v1.5.25:

  • rhcc, rhel: support compression of sideband data

  • datastore: add "delta" update interface

  • java: size buffers correctly before use

  • postgres: remove internal timeouts

  • integration: make PGVERSION a pattern

    Additionally, the version used is now read from the distributed manifest, rather than hard-coded versions. Other than occasional network calls to fetch this manifest, users shouldn't notice any difference.

  • alpine: add edge support

  • rpm: support PGP V4 signatures

  • jsonblob: add a disk buffering step

    This makes the API trickier but given that there's a single (known and intended) user, this should be fine.

  • tarfs: check a potential interger overflow

    The possibility of exploiting this is effectively 0, as it would require more bytes to represent a sufficiently large integer than is available in the tar header.

    See also: https://github.com/quay/claircore/security/code-scanning/5

  • gobin: take into account package replacements

  • all: purge http.DefaultClient usage

    This change breaks some API in exchange for unifying the *http.Client handling. The practical upshot is that it's much easier to control the network contact surface.

  • all: share single FS implementation

    This change should improve memory usage.

Unreleased

v4.7.2 - 2023-10-09

Claircore

• chore: update claircore to v1.5.19
• crda: remove crda support
• chore: update toolkit to latest version v1.1.1

Clair

• admin: add pre v4.7.3 admin command to create index

• contrib: add grafana dashboards for deletion metrics

• docs: add dropins to prose documentation