Unfixable vulnerabilities with ownership overlap in Ubuntu and distro managed Go binaries are reported as fixable

[BurningNetel]

What happened:
I'm not sure if #1373 "Filter out packages that are owned by OS packages" works correctly in the following usecase.

When scanning an up-to-date Ubuntu Noble container image with Go based packages installed (from Ubuntu sources) like containerd, runc or docker.io, even if the package is up to date from a OS distro sense, it will report hundreds of issues in the underlying go modules, even when running with the --only-fixed flag.

My understanding is that this should've been filtered out because these packages are owned by the OS and, if a issue affects these components Ubuntu USN system should be adequate to decide on any impacting issues to report. Instead, the go analyzer results are also considered, which causes a lot of unfixable issues because we cannot upgrade to a newer version of these components in the distro.

What you expected to happen:
That Grype ignores the go analyzer issues on files owned by distro managed packages, or that this behavior is more configurable.

How to reproduce it (as minimally and precisely as possible):
Create a Dockerfile

FROM ubuntu:24.04

RUN apt-get update && apt-get install -y \
    containerd \
    runc \
    docker.io \
    && apt-get upgrade -y 

ENTRYPOINT ["/bin/bash"]

Run docker build -t grype_test

grype --only-fixed grype_test

Anything else we need to know?:

Environment:

• Output of grype version:
  Application: grype
  Version: 0.116.0
  BuildDate: 2026-07-16T16:43:45Z
  GitCommit: 3b014b0
  GitDescription: v0.116.0
  Platform: linux/amd64
  GoVersion: go1.26.3
  Compiler: gc
  Syft Version: v1.48.0
  Supported DB Schema: 6

• OS (e.g: cat /etc/os-release or similar): Ubuntu 24.04.4 LTS

[kzantow]

Hey @BurningNetel, I had a look at this and I see the dpkg entry should own the binaries like /usr/bin/containerd, which as you understand should result in known fixed vulnerabilities to be filtered out. Just to be on the same page, could you provide some examples from the results you think should be removed by this mechanism?

[BurningNetel]

yes indeed, all files of a packages that are owned by the Distro (ubuntu in this case) which are at the latest version (so no fixes are possible for the distro), should be filtered out. Instead what happens is the go analyzer is still ran on files of these packages, resulting in Grype reporting issues which are not fixable (from a distro package management point of view).

I just ran the following to show which files are affected:

grype --only-fixed grype_test -o json > grype.json
jq -r '.matches[] | .artifact.locations[].path' grype.json | sort | uniq -c | sort -nr | head
     95 /usr/bin/dockerd
     84 /usr/bin/containerd
     53 /usr/bin/ctr
     53 /usr/bin/containerd-stress
     47 /usr/libexec/docker/cli-plugins/docker-trust
     40 /usr/bin/docker
     16 /usr/bin/containerd-shim-runc-v2
      5 /usr/sbin/runc
      5 /usr/bin/runc

All these files are owned by the apt packages of containerd, docker.io and runc:
Crossrefence with:
https://packages.ubuntu.com/noble-updates/amd64/docker.io/filelist
https://packages.ubuntu.com/noble-updates/amd64/containerd/filelist
https://packages.ubuntu.com/noble-updates/amd64/runc/filelist