From aaea1eaeda20cff3a830d49bb6c0888ef19001c7 Mon Sep 17 00:00:00 2001 From: knqyf263 Date: Fri, 26 Jul 2024 11:22:21 +0400 Subject: [PATCH] feat: return error for option combination, leading to incomplete results Signed-off-by: knqyf263 --- docs/docs/scanner/vulnerability.md | 3 --- pkg/flag/options.go | 2 +- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/docs/docs/scanner/vulnerability.md b/docs/docs/scanner/vulnerability.md index 58eceb3d5bc7..328d735c9709 100644 --- a/docs/docs/scanner/vulnerability.md +++ b/docs/docs/scanner/vulnerability.md @@ -304,9 +304,6 @@ By default, all relationships are included in the scan. !!! info This flag filters the packages themselves, so it also affects the `--list-all-pkgs` option and SBOM generation. -!!! warning - As it may not provide a complete package list, it can lead to incomplete dependency trees when using `--dependency-tree` or generate incomplete SBOMs. - [^1]: https://github.com/GoogleContainerTools/distroless diff --git a/pkg/flag/options.go b/pkg/flag/options.go index 2804a42d8b32..5f188f149986 100644 --- a/pkg/flag/options.go +++ b/pkg/flag/options.go @@ -375,7 +375,7 @@ func (o *Options) Align(f *Flags) error { if f.PackageFlagGroup != nil && f.PackageFlagGroup.PkgRelationships != nil && slices.Compare(o.PkgRelationships, ftypes.Relationships) != 0 && (o.DependencyTree || slices.Contains(types.SupportedSBOMFormats, o.Format) || o.VEXPath != "") { - log.Warn("Using '--pkg-relationships' may affect features that rely on package dependency information, such as SBOM relationships, dependency trees, and VEX filtering.") + return xerrors.Errorf("'--pkg-relationships' cannot be used with '--dependency-tree', '--vex' or SBOM formats") } if o.Compliance.Spec.ID != "" {