fix(alpine): add UID for removed packages (#7887)

aquasecurity · Nov 18, 2024 · 07915da · 07915da
1 parent 58fdab2
commit 07915da
Show file tree

Hide file tree

Showing 3 changed files with 590 additions and 83 deletions.
diff --git a/pkg/fanal/analyzer/imgconf/apk/apk.go b/pkg/fanal/analyzer/imgconf/apk/apk.go
@@ -16,6 +16,7 @@ import (
 	"github.com/samber/lo"
 	"golang.org/x/xerrors"
 
+	"github.com/aquasecurity/trivy/pkg/dependency"
 	"github.com/aquasecurity/trivy/pkg/fanal/analyzer"
 	"github.com/aquasecurity/trivy/pkg/fanal/types"
 )
@@ -134,6 +135,7 @@ func (a alpineCmdAnalyzer) parseConfig(apkIndexArchive *apkIndex, config *v1.Con
 		pkgs = a.resolveDependencies(apkIndexArchive, pkgs)
 		results := a.guessVersion(apkIndexArchive, pkgs, history.Created.Time)
 		for _, result := range results {
+			result.Identifier.UID = dependency.UID("", result)
 			uniqPkgs[result.Name] = result
 		}
 	}