Repository navigation
Conversation
crozzy
force-pushed
the
stream-vulns-when-matching
branch
from
October 1, 2026 23:16
9e9e111 to
9c15c5c
Compare
crozzy
marked this pull request as ready for review
October 1, 2026 23:17
hdonnay
reviewed
Oct 2, 2026
jvdm
reviewed
Oct 9, 2026
| // Vulnerable reports whether a scanned vulnerability affects this record. | ||
| // A nil Vulnerable retains every row. When several records share a package | ||
| // ID, the row is retained if any of them accepts it. | ||
| Vulnerable func(ctx context.Context, record *claircore.IndexRecord, vuln *claircore.Vulnerability) (bool, error) |
Contributor
There was a problem hiding this comment.
Could we document that Vulnerable runs while the database transaction and batch are open? Callback implementations should be aware of database access or other blocking steps.
Contributor
Author
There was a problem hiding this comment.
Yeah I can add something but probably not here as it is implementation-agnostic
Contributor
Author
There was a problem hiding this comment.
| Debug: true, | ||
| VersionFiltering: dbSide, | ||
| } | ||
| if !authoritative { |
Contributor
There was a problem hiding this comment.
Could we add a test asserting that Vulnerable is not called on that path?
Contributor
Author
There was a problem hiding this comment.
Added TestMatchAuthoritativeOmitsVulnerable
crozzy
force-pushed
the
stream-vulns-when-matching
branch
from
October 9, 2026 16:21
9c15c5c to
063460e
Compare
|
Triggered from #2049 by @crozzy. Checking if we can fast forward Target branch ( commit 5cef92c3fa36919729c603da7e8e12d1d926c2ef (HEAD -> main, tag: v1.6.1, origin/main)
Author: David Caravello <119438707+dcaravel@users.noreply.github.com>
Date: Thu Oct 8 17:50:47 2026 -0500
chore: v1.6.1 changelog bump
Signed-off-by: David Caravello <119438707+dcaravel@users.noreply.github.com>Pull request ( commit 063460e1122c17a94c06eddf7695b45cad92e56d (pull_request/stream-vulns-when-matching)
Author: Joseph Crosland <jcroslan@redhat.com>
Date: Wed Sep 30 12:49:39 2026 -0700
datastore: drop non-matching vulnerabilities while scanning Get()
This change analyses the vulnerability and record as it is streamed
from the database instead of buffering all the vulnerabilities into
memory and then analysing. This change reduces the memory consumption
during matching significantly but it doesn't change how many vulnerabilities
are return from the database.
Signed-off-by: crozzy <joseph.crosland@gmail.com>Can't fast forward * 063460e1122c17a94c06eddf7695b45cad92e56d datastore: drop non-matching vulnerabilities while scanning Get()
| * 5cef92c3fa36919729c603da7e8e12d1d926c2ef chore: v1.6.1 changelog bump
| * a3dbce3d38950a888c012a680f597128f403aa39 documentation: clarify latest release after branch releases
| * 531d0d4c986e607b9e5ed2ae44253baadf485e2f chore(deps): bump github.com/klauspost/compress from 1.20.0 to 1.20.1
|/
* 4b16410062d2ba61ef16354984f8994f1d83d233 datastore: intern vulnerabilities by ID by pre-peeking at results
commit 4b16410062d2ba61ef16354984f8994f1d83d233
Author: Joseph Crosland <jcroslan@redhat.com>
Date: Mon Sep 21 12:49:22 2026 -0700
datastore: intern vulnerabilities by ID by pre-peeking at results
It is fairly common for different queries to pull overlapping vulnerability results
when they share a source package (i.e. "kernel"). This means every package with a
common source will likely be leading to a vast majority of duplicate vulnerabilities.
Signed-off-by: crozzy <joseph.crosland@gmail.com>Rebase locally, and then force push to |
crozzy
force-pushed
the
stream-vulns-when-matching
branch
from
October 9, 2026 16:23
063460e to
90684ff
Compare
|
Triggered from #2049 by @crozzy. Checking if we can fast forward Target branch ( commit 5cef92c3fa36919729c603da7e8e12d1d926c2ef (HEAD -> main, tag: v1.6.1, origin/main)
Author: David Caravello <119438707+dcaravel@users.noreply.github.com>
Date: Thu Oct 8 17:50:47 2026 -0500
chore: v1.6.1 changelog bump
Signed-off-by: David Caravello <119438707+dcaravel@users.noreply.github.com>Pull request ( commit 90684ffb8f8797b1e11fc3636336d4c9c4ccd7f7 (pull_request/stream-vulns-when-matching)
Author: Joseph Crosland <jcroslan@redhat.com>
Date: Wed Sep 30 12:49:39 2026 -0700
datastore: drop non-matching vulnerabilities while scanning Get()
This change analyses the vulnerability and record as it is streamed
from the database instead of buffering all the vulnerabilities into
memory and then analysing. This change reduces the memory consumption
during matching significantly but it doesn't change how many vulnerabilities
are return from the database.
Signed-off-by: crozzy <joseph.crosland@gmail.com>Can't fast forward * 90684ffb8f8797b1e11fc3636336d4c9c4ccd7f7 datastore: drop non-matching vulnerabilities while scanning Get()
| * 5cef92c3fa36919729c603da7e8e12d1d926c2ef chore: v1.6.1 changelog bump
| * a3dbce3d38950a888c012a680f597128f403aa39 documentation: clarify latest release after branch releases
| * 531d0d4c986e607b9e5ed2ae44253baadf485e2f chore(deps): bump github.com/klauspost/compress from 1.20.0 to 1.20.1
|/
* 4b16410062d2ba61ef16354984f8994f1d83d233 datastore: intern vulnerabilities by ID by pre-peeking at results
commit 4b16410062d2ba61ef16354984f8994f1d83d233
Author: Joseph Crosland <jcroslan@redhat.com>
Date: Mon Sep 21 12:49:22 2026 -0700
datastore: intern vulnerabilities by ID by pre-peeking at results
It is fairly common for different queries to pull overlapping vulnerability results
when they share a source package (i.e. "kernel"). This means every package with a
common source will likely be leading to a vast majority of duplicate vulnerabilities.
Signed-off-by: crozzy <joseph.crosland@gmail.com>Rebase locally, and then force push to |
crozzy
force-pushed
the
stream-vulns-when-matching
branch
from
October 9, 2026 16:50
90684ff to
bd9ed8d
Compare
|
Triggered from #2049 by @crozzy. Checking if we can fast forward Target branch ( commit 5cef92c3fa36919729c603da7e8e12d1d926c2ef (HEAD -> main, tag: v1.6.1, origin/main)
Author: David Caravello <119438707+dcaravel@users.noreply.github.com>
Date: Thu Oct 8 17:50:47 2026 -0500
chore: v1.6.1 changelog bump
Signed-off-by: David Caravello <119438707+dcaravel@users.noreply.github.com>Pull request ( commit bd9ed8dc85d0184795b52260b4df5f07b0172042 (pull_request/stream-vulns-when-matching)
Author: Joseph Crosland <jcroslan@redhat.com>
Date: Wed Sep 30 12:49:39 2026 -0700
datastore: drop non-matching vulnerabilities while scanning Get()
This change analyses the vulnerability and record as it is streamed
from the database instead of buffering all the vulnerabilities into
memory and then analysing. This change reduces the memory consumption
during matching significantly but it doesn't change how many vulnerabilities
are return from the database.
Signed-off-by: crozzy <joseph.crosland@gmail.com>Can't fast forward * bd9ed8dc85d0184795b52260b4df5f07b0172042 datastore: drop non-matching vulnerabilities while scanning Get()
| * 5cef92c3fa36919729c603da7e8e12d1d926c2ef chore: v1.6.1 changelog bump
| * a3dbce3d38950a888c012a680f597128f403aa39 documentation: clarify latest release after branch releases
| * 531d0d4c986e607b9e5ed2ae44253baadf485e2f chore(deps): bump github.com/klauspost/compress from 1.20.0 to 1.20.1
|/
* 4b16410062d2ba61ef16354984f8994f1d83d233 datastore: intern vulnerabilities by ID by pre-peeking at results
commit 4b16410062d2ba61ef16354984f8994f1d83d233
Author: Joseph Crosland <jcroslan@redhat.com>
Date: Mon Sep 21 12:49:22 2026 -0700
datastore: intern vulnerabilities by ID by pre-peeking at results
It is fairly common for different queries to pull overlapping vulnerability results
when they share a source package (i.e. "kernel"). This means every package with a
common source will likely be leading to a vast majority of duplicate vulnerabilities.
Signed-off-by: crozzy <joseph.crosland@gmail.com>Rebase locally, and then force push to |
crozzy
force-pushed
the
stream-vulns-when-matching
branch
from
October 9, 2026 17:14
bd9ed8d to
b49c904
Compare
|
Triggered from #2049 by @crozzy. Checking if we can fast forward Target branch ( commit 5cef92c3fa36919729c603da7e8e12d1d926c2ef (HEAD -> main, tag: v1.6.1, origin/main)
Author: David Caravello <119438707+dcaravel@users.noreply.github.com>
Date: Thu Oct 8 17:50:47 2026 -0500
chore: v1.6.1 changelog bump
Signed-off-by: David Caravello <119438707+dcaravel@users.noreply.github.com>Pull request ( commit b49c9048061853941bed6a59b78c50c6b1bdcaf8 (pull_request/stream-vulns-when-matching)
Author: Joseph Crosland <jcroslan@redhat.com>
Date: Wed Sep 30 12:49:39 2026 -0700
datastore: drop non-matching vulnerabilities while scanning Get()
This change analyses the vulnerability and record as it is streamed
from the database instead of buffering all the vulnerabilities into
memory and then analysing. This change reduces the memory consumption
during matching significantly but it doesn't change how many vulnerabilities
are return from the database.
Signed-off-by: crozzy <joseph.crosland@gmail.com>Can't fast forward * b49c9048061853941bed6a59b78c50c6b1bdcaf8 datastore: drop non-matching vulnerabilities while scanning Get()
| * 5cef92c3fa36919729c603da7e8e12d1d926c2ef chore: v1.6.1 changelog bump
|/
* a3dbce3d38950a888c012a680f597128f403aa39 documentation: clarify latest release after branch releases
commit a3dbce3d38950a888c012a680f597128f403aa39
Author: David Caravello <119438707+dcaravel@users.noreply.github.com>
Date: Thu Oct 8 09:36:25 2026 -0500
documentation: clarify latest release after branch releases
Publishing a patch release from an older release branch can move
GitHub's Latest label away from the highest stable version. Document
how to restore the label and verify the latest release link.
Signed-off-by: David Caravello <119438707+dcaravel@users.noreply.github.com>Rebase locally, and then force push to |
This change analyses the vulnerability and record as it is streamed from the database instead of buffering all the vulnerabilities into memory and then analysing. This change reduces the memory consumption during matching significantly but it doesn't change how many vulnerabilities are return from the database. Signed-off-by: crozzy <joseph.crosland@gmail.com>
crozzy
force-pushed
the
stream-vulns-when-matching
branch
from
October 9, 2026 17:16
b49c904 to
bca75d2
Compare
jvdm
approved these changes
Oct 9, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change analyses the vulnerability and record as it is streamed from the database instead of buffering all the vulnerabilities into memory and then analysing. This change reduces the memory consumption during matching significantly but it doesn't change how many vulnerabilities are return from the database.