Repository navigation
Conversation
crozzy
force-pushed
the
cyclone-dx-java-match
branch
4 times, most recently
from
October 9, 2026 21:45
8be49b9 to
ee6f9ff
Compare
crozzy
force-pushed
the
cyclone-dx-java-match
branch
8 times, most recently
from
October 19, 2026 22:40
1237ce6 to
f677e0d
Compare
crozzy
force-pushed
the
cyclone-dx-java-match
branch
2 times, most recently
from
October 21, 2026 17:51
91b5dc7 to
3d92286
Compare
crozzy
marked this pull request as ready for review
October 21, 2026 18:16
BradLugo
self-requested a review
October 23, 2026 18:31
RepositoryKey is the key for a Red Hat product CPE attributed to a Java component. Signed-off-by: crozzy <joseph.crosland@gmail.com>
pkg:maven rows are now accepted. The package name is namespace:name, ignoring repository_url and type. FixedInVersion is the PURL version for a fixed row. Maven known_not_affected rows are skipped, and a versioned known_affected Maven PURL is not ingested. TODO: resolve what a version on a known_affected Maven PURL means. TODO: move the feed URL back to the production vex-feed once Maven data is published there. Signed-off-by: crozzy <joseph.crosland@gmail.com>
The matcher selects redhat-java-cpe-repository records. It applies the RHEL CPE check, then compares Maven versions: an installed package is vulnerable when it is strictly older than FixedInVersion, and an empty FixedInVersion matches any installed version. Signed-off-by: crozzy <joseph.crosland@gmail.com>
crozzy
force-pushed
the
cyclone-dx-java-match
branch
from
October 23, 2026 21:37
3d92286 to
01e8d32
Compare
BradLugo
reviewed
Oct 23, 2026
BradLugo
left a comment
BradLugo
left a comment
Contributor
There was a problem hiding this comment.
I have some other discussion points, but won't block on them for the sake of time
| slog.WarnContext(ctx, "unable to unbind repo CPE", "reason", err, "vulnerability name", vuln.Name) | ||
| return false, nil | ||
| } | ||
| if !cpe.Compare(vuln.Repo.CPE, record.Repository.CPE).IsSuperset() && !rhel.IsCPESubstringMatch(record.Repository.CPE, vuln.Repo.CPE) { |
Contributor
There was a problem hiding this comment.
I suspect substring matching will produce unexpected results (e.g., 1 > 10)
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.