roxctl image scan - fixableCves field missing

オープン
  • 何か問題がありますか？
#20,185 コメント 3 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
説明が足りない
活発さ
静か
技術スタック
go
領域
cli, security

調査の方向性

Start at the roxctl image scan command's handling of the default output and --output json. Compare how fixableCves is represented when no CVEs are fixable versus when fixable CVEs exist, then look for related output or serialization tests. Done means the intended output behavior is defined and consistently verified for both output modes.

索引モデルが issue の本文から書いたものです。

説明

Hi, I'm running ACS 4.9.2 and roxctl 4.9.2

I've noticed differences in behaviour related to the .fixableCves when roxctl scanning various images:

For images with no fixable CVEs, the generated JSON may or may not include "fixableCves": 0

export SCAN_IMAGE="registry.access.redhat.com/ubi10/ubi-minimal:10.1"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | jq '. | .fixableCves'

null

export SCAN_IMAGE="alpine:3.23"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | jq '. | .fixableCves'

0

If I look at what fields are present:

export SCAN_IMAGE="registry.access.redhat.com/ubi10/ubi-minimal:10.1"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | tail -10

      }
    ],
    "fetched": "2026-04-23T09:49:58.795410347Z"
  },
  "components": 97,
  "cves": 70,
  "lastUpdated": "2026-04-23T09:49:58.846701686Z",
  "riskScore": 6.8999996,
  "topCvss": 8.1
}

export SCAN_IMAGE="alpine:3.23"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify | tail -10

  "components": 16,
  "cves": 0,
  "fixableCves": 0,
  "lastUpdated": "2026-04-23T09:50:17.312875104Z",
  "riskScore": 1.3,
  "notes": [
    "MISSING_SIGNATURE",
    "MISSING_SIGNATURE_VERIFICATION_DATA"
  ]
}

If I try including the --output json flag, it appears the fixableCves key has been dropped?

Using alpine:3.23 there are no CVEs, and so no componentFixedVersion nor fixableCves summary:

export SCAN_IMAGE="alpine:3.23"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify --output json | grep -i fix

Using registry.access.redhat.com/ubi10/ubi-minimal:10.1 there are CVEs, but none are fixable, so componentFixedVersion are present, but there is no fixableCves summary:

export SCAN_IMAGE="registry.access.redhat.com/ubi10/ubi-minimal:10.1"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify --output json | grep -i fix
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""
        "componentFixedVersion": ""

Confirmation of output if fixable CVEs are present in the image (using alpine:3.19):

export SCAN_IMAGE="alpine:3.19"
roxctl image scan -f --retries=3 --retry-delay=3 --endpoint https://localhost:8443 --image $SCAN_IMAGE --insecure-skip-tls-verify --output json | grep -i fix

        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.2.4_git20230717-r6"
        "componentFixedVersion": "1.36.1-r21"
        "componentFixedVersion": "1.36.1-r21"

I guess I therefore have three questions:

  1. Without the --output flag, what is the default output style?
  2. Without the --output flag, why is fixableCves sometimes not present if there are no fixable CVEs, vs other times it's set as 0?
  3. Why when using --output json do I no longer get a total number of fixable CVEs included in the JSON (as this is useful for scripts to use in pipeline logging)?

Thanks in advance.

主要言語
Go
スター
1.3k
フォーク
194
平均マージ
2日 20時間
マージ済み PR（30日）
392

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

stackrox/stackrox のほかの issue

stackrox/stackrox の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。