Inconsistent output about CVEs

[dryewo]

When one requests pierone tags summary with Pierone CLI like this:

pierone tags ci cloud-kraken

it sometimes shows outdated information (NO_CVES_FOUND, for example), however, pierone cves shows up-to-date info for a specific image version:

pierone cves ci cloud-kraken 4242

Shows an up-to-date list of CVEs (including recent HIGH ones)

[rafaelcaricio]

Is it a bug in CLI or service BE?

[dryewo]

We'll have to find out, but most likely it's either Pierone backend (might be losing some notifications from Clair) or even Clair itself (might not be resending the notifications about updated analysis results).

[rafaelcaricio]

Ok. Pier One CLI does not cache any data. So I think the problem is not in the CLI.

[ovolynets]

Can we plan a one-time test with e.g. pushing/deploying artifacts with CVEs and check where it fails? For all our applications not older than ~30-50 days it always shows "NoCVEsFound", which means some changes happened around this time in the past

[dryewo]

We did test runs, so far it looks that with each CVE update clair-sqs is failing to send some of the affected images to pierone. The reasons are still unclear, we need to investigate further.