Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-71837

Tracking: pip in .dist-info/INSTALLER confuses clair-scan

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Undefined Undefined
    • rhel-10.1
    • None
    • python-setuptools
    • None
    • rhel-pt-python
    • ssg_platform_tools
    • PT Python 2025 S08
    • 2
    • False
    • Hide

      None

      Show
      None
    • None

      Steps to reproduce

      $ podman run -ti --rm registry.access.redhat.com/ubi9/ubi:9.5 cat /usr/lib/python3.9/site-packages/setuptools-53.0.0.dist-info/INSTALLER

      Actual results

      pip

      Expected results

      rpm

      More info

      $ podman run -ti --rm registry.access.redhat.com/ubi9/ubi:9.5 rpm -qf /usr/lib/python3.9/site-packages/setuptools-53.0.0.dist-info/INSTALLER
      python3-setuptools-53.0.0-13.el9.noarch

      As described in CLAIRDEV-115, clair-scan consults .dist-info/INSTALLER, and when it says 'pip', it wrongly assumes the package was installed with pip and claims the package has some CVE false-positives as a result.

              rhn-support-lzachar Lukas Zachar
              jpopelka@redhat.com Jiri Popelka
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: