From fcde9c879a56790566949e646fa35c937971eeff Mon Sep 17 00:00:00 2001 From: Evan Jarrett Date: Sat, 5 Sep 2026 15:38:07 -0500 Subject: [PATCH] docs: record why an all-negligible image is not rendered as clean The previous wording called the 0 0 0 0 strip a visible consequence worth closing and named a route to close it, which invites exactly the change it should prevent. Clean is not the same as nothing worth reporting. A clean image has no findings; an image whose findings are all Negligible or Unknown has findings, none of which rise to a flagged severity, and the vulnerabilities tab lists what the strip does not. Rendering it as clean would assert something untrue. The headline exceeding the four counts is the same distinction: the total is how many were found, the boxes are how many merit action. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01U1Km3N3uUmeGaj7VbaM8PF --- SCANNER_BUGS.md | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/SCANNER_BUGS.md b/SCANNER_BUGS.md index 716d4d3..582e3f6 100644 --- a/SCANNER_BUGS.md +++ b/SCANNER_BUGS.md @@ -81,14 +81,21 @@ worth flagging in most cases. The four boxes are a deliberate summary of what merits attention, not an exhaustive partition of the total, and the detail table already lists every finding including the unbucketed ones. -Two narrow consequences remain visible and are recorded so the next reader does -not mistake them for oversights: the headline "N vulnerabilities" beside the -four boxes is a larger number than they sum to on multi-severity distros, and an -image whose findings are *entirely* Negligible or Unknown has `Total > 0`, so it -skips the "Clean" branch and renders a coloured strip reading `0 0 0 0`. If -either is ever worth addressing, the cheap route is to derive the headline from -the four counts rather than adding a fifth bucket, which needs no lexicon or -protocol change. +Two consequences follow, and both are intended. Recorded here because each +looks like a rendering bug from the code alone, and the next reader should not +"correct" them. + +The headline "N vulnerabilities" beside the four boxes is a larger number than +they sum to on multi-severity distros. That is the point: the total is the +finding count, the boxes are the ones worth acting on. + +An image whose findings are *entirely* Negligible or Unknown has `Total > 0`, +so it skips the "Clean" branch and renders a coloured strip reading `0 0 0 0`. +This is correct, because **"clean" is not the same as "nothing worth +reporting"**. A clean image has no findings at all; this one has findings, none +of which rise to a flagged severity. Rendering it as Clean would assert +something untrue, and the vulnerabilities tab lists exactly what the strip does +not. **The 512 MiB `GOMEMLIMIT` does not scale with `scanner.workers`.** Process-wide rather than per-worker, so it is divided among concurrent scans: +1.7% for a