Skip to content

some non-PEP440 version constraints for GHSA python packages in grype-db #2229

Open
@willmurphyscode

Description

@willmurphyscode

Hello,
I'm facing the same issue with grype 0.83.0
[0222] ERROR failed to inflate vulnerability record (by language): failed to parse constraint='>=1.7.0,<1.9.0ubuntu1.2' format='Python': unable to parse pep440 constrain phrase failed to create comparator for '&{< 1.9.0ubuntu1.2}': unable to parse

Originally posted by @de4Ru in #2195 (comment)

edit: here's an example of the records that can't be inflated:

SELECT 
    id, namespace, version_constraint 
FROM vulnerability 
WHERE
     version_constraint like "%0ubuntu1%" and namespace like "%python%";'

against a current grype db produces:

id namespace version_constraint
GHSA-pj65-3pf6-c5q4 github:language:python >=1.7.0,<1.9.0ubuntu1.2
GHSA-rp8m-h266-53jh github:language:python >=1.7.0,<1.9.0ubuntu1.2

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    Status

    Ready

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions