Add Echo Linux vulnerability scanning support#2427
Open
Conversation
Add the foundation for Echo Linux support in Clair. The distribution scanner reads /etc/os-release from container image layers and identifies Echo images by checking for ID="echo". Release helpers manage cached distribution objects used throughout the Echo package. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a matcher for Echo Linux that uses dpkg version comparison to determine if a package is vulnerable. Echo uses apt/dpkg under the hood, so the go-deb-version library (already a project dependency) provides the correct version comparison semantics. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add an updater that fetches Echo's advisory data from advisory.echohq.com/data.json, and a parser that converts the JSON into claircore vulnerability records. The advisory URL is configurable via the updater config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Register the Echo updater and matcher via init() so they are available when Clair starts. Override the default indexer ecosystems to include the Echo distribution scanner in the dpkg ecosystem, enabling Clair to detect Echo images alongside Debian and Ubuntu. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update the configuration defaults documentation, sample config, and reference docs to include the Echo updater set and echo-matcher. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The echo package directly imports go-deb-version for dpkg version comparison in the matcher, so it should be listed as a direct dependency rather than indirect. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Author
|
depends on |
Author
|
evidence that echo.ai integration works: and: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
echopackage that implements the full Clair scanning pipeline for Echo Linux: distribution scanner, vulnerability updater, advisory parser, andversion-aware matcher
os-release(ID=echo)Design
The implementation follows the same patterns as existing distro integrations (Debian, Ubuntu, Alpine):
os-releaseforID=echoadvisory.echohq.com/data.json), producingclaircore.Vulnerabilityrecords keyed bysource package
DID=echoand uses Debian version comparison (go-deb-version) to determine if an installed package is older than the fixedversion
The Echo updater and matcher are registered via
init()inecho/defaults.goand imported as side-effects incmd/clairandcmd/clairctl.initialize/services.gois updated to explicitly setlibindex.Options.Ecosystemsso the Echo dpkg ecosystem is included in indexing.Files changed
echo/*.go(7 files)initialize/services.gocmd/clair/main.goechofor side-effect registrationcmd/clairctl/main.go,export.goechofor side-effect registrationconfig/updaters.go,matchers.goechoandecho-matcherin config commentsconfig.yaml.sample,Documentation/reference/config.mdgo.modgo-deb-versionto direct dependencyTest plan
go build ./cmd/...compiles successfully🤖 Generated with Claude Code