docs: explain how VEX is applied #6864
Conversation
Signed-off-by: knqyf263 <[email protected]>
|
|
||
| ### Applying VEX to Dependency Trees | ||
|
|
||
| Trivy internally generates a dependency tree and applies VEX statements to this graph. |
There was a problem hiding this comment.
maybe link to the dependency tree docs for more info?
https://aquasecurity.github.io/trivy/v0.52/docs/configuration/reporting/#show-origins-of-vulnerable-dependencies
There was a problem hiding this comment.
I think this can be confusing.
This logic is not related to the dependency tree display.
| "vulnerability": {"name": "CVE-XXXX-YYYY"}, | ||
| "products": [ | ||
| { | ||
| "@id": "pkg:golang/[email protected]", |
There was a problem hiding this comment.
We check all parents of the dependency tree.
Can we add information that either parent can be used(parent of parent, etc.)?
I mean is that for this case we can choose module-b or module-a.
|
|
||
| ### Applying VEX to Dependency Trees | ||
|
|
||
| Trivy internally generates a dependency tree and applies VEX statements to this graph. |
There was a problem hiding this comment.
I think this can be confusing.
This logic is not related to the dependency tree display.
Signed-off-by: knqyf263 <[email protected]>
knqyf263
force-pushed
the
docs/vex_internal
branch
from
4a9024b to
7ab49ef
Compare
Signed-off-by: knqyf263 <[email protected]>
knqyf263
force-pushed
the
docs/vex_internal
branch
from
7ab49ef to
51e8b4f
Compare
|
This document should have been part of v0.52.0. I'll backport it to release/v0.52 so v0.52.1 release will update the v0.52 document. |
|
@aqua-bot backport release/v0.52 |
Signed-off-by: knqyf263 <[email protected]>
|
Backport PR created: #6879 |
Description
Better describe how VEX is applied in the dependency tree
Related PRs
Remove this section if you don't have related PRs.
Checklist