One row per library, naming the artefacts it sits in - #65
Merged
Conversation
Since a Dockerfile candidate is scanned as the image it produces, a library is found once per image that contains it and once in the lockfile that declares it. The currency note is stamped by purl, so every copy carried it and sections 2 and 4 listed the same library up to three times — three rows for one decision, and headline counts to match: one report showed 38 libraries beyond the update limit where there were 19. Rows are collapsed by purl and the artefacts merged, printed under the library name so it stays visible where each one sits. The bundle keeps the copies: CycloneDX carries a component per occurrence and the artefact assignment is used elsewhere. Column widths rebalanced within the same 170mm to fit the artefact list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since #63 a Dockerfile candidate is scanned as the image it produces, so the shipped images carry the application's dependency tree. A library is now found once per image that contains it and once in the lockfile that declares it, and
annotate_bomstamps the currency note by purl — so every copy carries it.Sections 2 and 4 built one row per component, which meant up to three rows for one library and one decision:
The headline tiles counted the same way. One report showed 38 libraries beyond the update limit where there are 19, and 33 stale-or-deprecated where there are 16.
Rows are now collapsed by purl, the artefacts merged and printed under the library name:
The bundle is untouched — CycloneDX carries a component per occurrence, and the artefact assignment is used by the remediation grouping, which already deduplicated correctly.
Column widths rebalanced within the same 170mm. 235 passed, 0 failed.