roxctl image scan - fixableCves field missing

Abierto
  • ¿Algo no está bien?
#20,185 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Tranquilo
Stack tecnológico
go
Área
cli, security

Línea de trabajo

Start at the roxctl image scan command's handling of the default output and --output json. Compare how fixableCves is represented when no CVEs are fixable versus when fixable CVEs exist, then look for related output or serialization tests. Done means the intended output behavior is defined and consistently verified for both output modes.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Hi, I'm running ACS 4.9.2 and roxctl 4.9.2

I've noticed differences in behaviour related to the .fixableCves when roxctl scanning various images:

For images with no fixable CVEs, the generated JSON may or may not include "fixableCves": 0

export SCAN_IMAGE="registry.access.redhat.com/ubi10/ubi-minimal:10.1"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | jq '. | .fixableCves'

null

export SCAN_IMAGE="alpine:3.23"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | jq '. | .fixableCves'

0

If I look at what fields are present:

export SCAN_IMAGE="registry.access.redhat.com/ubi10/ubi-minimal:10.1"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | tail -10

      }
    ],
    "fetched": "2026-04-23T09:49:58.795410347Z"
  },
  "components": 97,
  "cves": 70,
  "lastUpdated": "2026-04-23T09:49:58.846701686Z",
  "riskScore": 6.8999996,
  "topCvss": 8.1
}

export SCAN_IMAGE="alpine:3.23"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | tail -10

  "components": 16,
  "cves": 0,
  "fixableCves": 0,
  "lastUpdated": "2026-04-23T09:50:17.312875104Z",
  "riskScore": 1.3,
  "notes": [
    "MISSING_SIGNATURE",
    "MISSING_SIGNATURE_VERIFICATION_DATA"
  ]
}

If I try including the --output json flag, it appears the fixableCves key has been dropped?

Using alpine:3.23 there are no CVEs, and so no componentFixedVersion nor fixableCves summary:

export SCAN_IMAGE="alpine:3.23"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify --output json | grep -i fix

Using registry.access.redhat.com/ubi10/ubi-minimal:10.1 there are CVEs, but none are fixable, so componentFixedVersion are present, but there is no fixableCves summary:

export SCAN_IMAGE="registry.access.redhat.com/ubi10/ubi-minimal:10.1"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify --output json | grep -i fix
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""

Confirmation of output if fixable CVEs are present in the image (using alpine:3.19):

export SCAN_IMAGE="alpine:3.19"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify --output json | grep -i fix

        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"

I guess I therefore have three questions:

  1. Without the --output flag, what is the default output style?
  2. Without the --output flag, why is fixableCves sometimes not present if there are no fixable CVEs, vs other times it's set as 0?
  3. Why when using --output json do I no longer get a total number of fixable CVEs included in the JSON (as this is useful for scripts to use in pipeline logging)?

Thanks in advance.

Lenguaje dominante
Go
Estrellas
1.3k
Forks
194
Merge medio
2 d 20 h
PR fusionados (30 d)
392

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stackrox/stackrox

Todos los issues de stackrox/stackrox

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.