Log when Image pushed package-manager is not supported

[jgsqware]

Hello,

i've pushed some layers but was on alpine and so Package Manager is not handled yet by Clair.

Could we have a notification in the log that this kind of layers is not handle?

Thanks

Julien

[Quentin-M]

Hi,

Thanks for your feedback. I understand your concern.

The difficulty is that being able to say that something is not supported requires some form of support already. Currently, Clair is able to tell when a layer is not supported, via the API and in the logs, in two cases:

• An OS has been detected in the submitted layer but is not explicitly supported (https://github.com/coreos/clair/blob/master/worker/worker.go#L220).
• Some packages have been detected but the OS is unknown (https://github.com/coreos/clair/blob/master/worker/worker.go#L161).

In order to effectively say that Alpine is not supported (yet), either its OS detector or its package detector must be implemented.

Also, we should note that a contributor started an Alpine Linux branch recently. Also, #12.

Seeing that the package list of final layer is empty should be a good indicator that Clair doesn't support the image. Clair 0.1 will actually embed vulnerabilities directly under the packages they affect on a layer. Using that view, it will become really clear that we can't tell the image's vulnerabilities because no package has been detected.

[jgsqware]

Ok I get it Thank Quentin