Add CVE image tool to security updates documentation - #643
Conversation
Added information about a community tool for checking CVEs in images built on Konflux.
PR Summary by QodoDocument community CVE checker for Konflux-built images
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Code Review by Qodo
1.
|
|
This is how the output looks like in the .md format |
|
This is the first time I'm hearing about such tool. How does it relate to MintMaker? Wouldn't this be more related to build/release time? |
|
With the The tool can also be used before the release to outline which CVEs were fixed since the previous release. |
|
Does it show different information than the security PRs MintMaker already generates? |
|
Mintmaker/renovate shows which CVE(s) are fixed in a given PR. This tool creates an overview of:
|
|
Also the mintmaker sometimes does not show any CVEs fixed in the security PR e.g. os-observability/konflux-opentelemetry#950. Also it shows only high,moderate. The tool in this PR can show all CVEs. |
|
Also the tool can show medium and low vulnerabilities which I don't think are considered by mintmaker. |
Added information about a community tool for checking CVEs in images built on Konflux.
Add link to https://github.com/os-observability/konflux-opentelemetry/tree/main/tools/image-cve-check which we use for CVE investigation and mintmaker rpm.lock file checks.
When
--lockfileis specified it checks if the package was updated in the lockfile and mentions it in the report.