Klar Versions Save

Many new features were developed by the community members:

• Add support for ignoring unfixed vulnerabilitie by @mterron
• New exit status, to distinguish between runtime errors and vulnerbilities being present by @cafuego
• Use proxy variables for docker communication by @neumayer
• Table formatting to output @nickmintel
• Multiple output format support by @jeff-knurek
• Update docs to note basic authentication support by @qiq
• Fix json format output by @nickmintel

API V3 support seems to be broken by the latest Clair's master, we will try to update our code.

• Add support for ignoring unfixed vulnerabilities bu @mterron

One (almost) breaking change in whitelist functionality:

• Use whitelist for specific image instead of base by @mbode

Also

• Fix feature version json tag credits to @jcodybaker

Fix JSON output regression introduced in 2.1.0, thanks to @vasartori

The biggest community-driven release in Klar's history, thank you!

• Support for whitelisting CVEs and additional detail in the output report by @thereverendtom
• Support to configure docker/clair timeouts (CLAIR_TIMEOUT, DOCKER_TIMEOUT env vars) by @ppacher
• Support for existing registry tokens (DOCKER_TOKEN env var) by @jaumann
• Better Readme - spelling and Grammar changes by @ccsalway
• Bugfix - duplicate entries in output by @thereverendtom

Bug fix release:

• Can't pull fsLayers with public GCR image #83
• JSON output invalid #84

Internal refactoring and bugfix release

• https://github.com/optiopay/klar/issues/71

• Support of upcoming Clair V3 API (GRPC API) in Klar.
• Feature name (component) is added to vulnerability output.

Some background: support of V1 API (I'm not sure what happened with V2) was dropped in the master branch of Clair, so Clair V3 will have only GRPC API. You may try to build Clair V3 from master branch or use quay.io/coreos/clair-git docker image to test it.

Klar 2.0 supports both versions of API, it first tries to use V1 (JSON HTTP) API, if it fails Klar switches to V3.

• Support of upcoming Clair V3 API (GRPC API) in Klar.
• Feature name (component) is added to vulnerability output.

Some background: support of V1 API (I'm not sure what happened with V2) was dropped in the master branch of Clair, so Clair V3 will have only GRPC API. You may try to build Clair V3 from master branch or use quay.io/coreos/clair-git docker image to test it.

Klar 2.0 supports both versions of API, it first tries to use V1 (JSON HTTP) API, if it fails Klar switches to V3.

• Fully working support of Docker Image Manifest Version 2, Schema 2
• Fully working support of Clair V2
• Simple tracing support, set KLAR_TRACE=true to enable HTTP exchange tracing