Add Root IO provider labels for cassandra test image

[chait-slim]

Added vulnerability match labels for Root IO provider validation:

• Image: docker.io/rootpublic/cassandra:latest@sha256:02272b14efbe14e70ee5512ce707c4e300d3c1813f0e5df9562512c1b96be835
• 4 labels created for standard Ubuntu packages
• Root IO packages correctly show 0 matches (NAK pattern working)

These labels are required for the Root IO provider PR in vunnel.

[willmurphyscode]

Hi @chait-slim I am unable to pull the test image:

❯ docker pull cr.root.io/cassandra@sha256:b3cc918a6a364af0a6b0a45becef0d0979db7e604751fad627ec2a94945b4e03
Error response from daemon: failed to resolve reference "cr.root.io/cassandra@sha256:b3cc918a6a364af0a6b0a45becef0d0979db7e604751fad627ec2a94945b4e03": pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials

Am I missing something? Is it possible for you all to make an old tag public or something?

[chait-slim]

Hi @chait-slim I am unable to pull the test image:

❯ docker pull cr.root.io/cassandra@sha256:b3cc918a6a364af0a6b0a45becef0d0979db7e604751fad627ec2a94945b4e03
Error response from daemon: failed to resolve reference "cr.root.io/cassandra@sha256:b3cc918a6a364af0a6b0a45becef0d0979db7e604751fad627ec2a94945b4e03": pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials

Am I missing something? Is it possible for you all to make an old tag public or something?

Updated the image location: docker.io/rootpublic/cassandra:latest@sha256:02272b14efbe14e70ee5512ce707c4e300d3c1813f0e5df9562512c1b96be835

[willmurphyscode]

Hi @chait-slim can you add some labels that are FPs? As I understand the current plan is for the rootio provider to emit UnaffectedPackageHandles that prevent Grype from matching on vulnerabilities that Root has patched. When compared with a scan by Grype that doesn't know about rootio patches, this would be a False Positive. In other words, for the labels to prove that the approach is working, there should be matches that Grype finds without the rootio data, that it stops finding with the rootio data, that are labeled as False Positives, that is, as matches that it is correct for Grype to stop finding.

[chait-slim]

@willmurphyscode I've added another image that should have better labels

[willmurphyscode]

@chait-slim I'm confused. All of the labels in this branch have "label": "TP" in them. But when we're building a provider that works via NAKs / unaffectedPackageHandles, we need some false positives, that should have "label": "FP" in the JSON.

[willmurphyscode]

Hi @chait-slim just wanted to make sure we are not both waiting on each other. My understanding is that I am waiting for you to push some changes to this PR showing that some of grype's current findings against RootIO should be labeled "FP" (false positive) but everything still has "TP" labels in this PR.

Please let me know if there's anything I can do to help.

[chait-slim]

Hi Will, We are completely aligned here. I will get to this asap. Sorry for the delay

…

On Mon, 9 Mar 2026 at 22:10 Will Murphy ***@***.***> wrote: *willmurphyscode* left a comment (anchore/vulnerability-match-labels#167) <#167 (comment)> Hi @chait-slim <https://github.com/chait-slim> just wanted to make sure we are not both waiting on each other. My understanding is that I am waiting for you to push some changes to this PR showing that some of grype's current findings against RootIO should be labeled "FP" (false positive) but everything still has "TP" labels in this PR. Please let me know if there's anything I can do to help. — Reply to this email directly, view it on GitHub <#167 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BGQ4GPHNRVDCXQMZDK33EAL4P4QM3AVCNFSM6AAAAACQKAR6TWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DAMRWGU4DOMBWGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[chait-slim]

@willmurphyscode updated
Added FP labels for CVE-2016-20013 (libc-bin, libc6, locales) and CVE-2021-46848 (libtasn1-6) on both the cassandra and ubuntu rootpublic images.
These are vulnerabilities Root IO has patched — grype correctly suppresses them with the custom-db via unaffectedPackageHandles, so they should be
labeled FP, not left unlabeled.