'Needs Discussion' Review

General
1

Hello! We have used the needs-discussion label on our GitHub repos to indicate where issues or prs need further group discussion. I’ve collated the list as it stands now, below.

@wagoodman Please can the team to review the list, to further triage these tagged issues/prs in case they’re incorrectly tagged. Thanks!

The goal is to ensure we have current issues/prs to discuss on our Thursday Gardening session. This should also result in cleaning up items that no longer require discussion, need more information from the contributor(s), require design, or are ready to implement.

Issues needing discussion

grype issues

Issue Title
#2316 [DOCS] Document your CycloneDX properties
#2264 list of unrelated versions in the remediation
#2253 Incorrect cve fixed-in version coming in grype output
#2229 some non-PEP440 version constraints for GHSA python packa…
#1426 RFC: Explicit reporting of negative matches
#1409 Should we combine the grype and grype-db projects?
#972 Go mod pseudo-versions may cause false positive results
#522 should repeated invocations of grype produce identical fi…

syft issues

Issue Title
#3497 [DOCS] Document your CycloneDX properties
#3485 Configurable package merge behavior
#3470 syft should not warn on known bad package.json
#3455 Syft scan in offline mode is slow
#3386 Conan cataloger: distinquish normal and build requirement…
#3317 Duplicate package names
#3145 Support scanning filesystems without building an index
#3007 Control resolver parameters without indexing twice
#2989 Setting file.metadata.selection to none still results…
#2877 Syft incorrectly identifying jruby jar files
#2729 Scan images in Kubernetes manifest(s)
#1961 Add support for determining supplier of packages
#1100 Reproducible SBOMs

PRs needing discussion

syft PRs.

PR Title
#3462 Include the OS Information available in the SBOM model in…
1 Like
2

please check if you still need to discuss this - Squashed all layers by tomersein · Pull Request #3138 · anchore/syft · GitHub

you have talked about it few meetings, still waiting for further comments to move forward :slight_smile:

thanks!

3

@popey adding Improvements to scanning whole machine to “needs discussion” here.

2 Likes
4

@popey during triage today, @kzantow and I went through the whole list of needs discussion items. Everything on the list is current now.

Thanks for the reminder @TimBrown1611. That PR is waiting for a detailed code review, not a live stream discussion.

1 Like