Golang client for Clair v4 API

[seleznev]

Hello!

There are two golang clients in the repository:

• httptransport/client/ - looks outdated and not synced with current version of v4 API. For example, it handles http.StatusNotModified as an error in IndexReport().
• cmd/clairctl/client.go - uses by clairctl and works well, but can't be used because of /internal/ and etc.

What is recommended way to communicate with ClairV4 API from third-party golang applications? Should I redevelop client by myself or maybe things described above is a bug and can be fixed?

[hdonnay]

The httptransport/client is meant for intraservice use -- it implements interfaces so that the microservices can be swapped between local and remote implementations.

The client in clairctl is much closer to what an external client may want, but I haven't exported it out of an abundance of caution.

What sorts of things do you want to do with a clair client? Starting from there, we can probably sketch out an API for a go client package.

[seleznev]

Thank you for response, and sorry for delay! :(

What sorts of things do you want to do with a clair client?

I want something like clairctl report can do (vulnerabilities list by image name, if simplify).

However, I don't think that "high level" client (with encapsulating magic around docker images/manifests/digests) is a good idea (looks out of scope for clair), so I can't ask for it.

If you don't want/need a public client it is ok (it is some additional responsibility). I will try to generate client from openapi spec in this case (and it works good enough at first sight). I just want to known that it is a right way. :)

---

If you interested in some details/context. Currently, we use klar in CI/CD pipelines and self-made service to scan/rescan images which are running in our k8s clusters. Both uses Clair v2 and we want to upgrade to v4 branch.

klar seems abandoned, but it can be replaced by clairctl. AFAIK, it doesn't have some useful features (like filter by severity, exit with not zero return code if image has vulnerabilities), but it all can be solved with simple wrapper and -o json.

Our self-made service uses golang client from klar to interact with Clair API. So, I looking for replacement (I found https://pkg.go.dev/github.com/quay/clair/v4/httptransport/client on Google, but it looked broken, so I came here).

[glebsts]

So nothing changed in 2 years? I'm going same way now, from v2 to v4, and it is a pain with Klar being abandoned.