Clair is an open source project for the static analysis of vulnerabilities in
application containers (currently including OCI and docker).
Clients use the Clair API to index their container images and can then match it
against known vulnerabilities.
Our goal is to enable a more transparent view of the security of
container-based infrastructure. Thus, the project was named Clair after the
French term which translates to clear, bright, transparent.
Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.
