Does Clair Support Scanning Centos?

[acusworth]

I've configured updater to include RHEL and Alpine but when I run a report against an image using Centos as a base. The report doesn't appear to recognize the distribution but does pick up packages. It consistently returns the packages in the image but always reports no vulnerabilities.

Example vulnerability report:

{
  "manifest_hash": "sha256:b804d20e2c60eb9b34de6f2bdb99b87afaaac69111d6824bc11c281f075228fc",
  "packages": {
    "60": {
      "id": "60",
      "name": "shared-mime-info",
      "version": "1.8-5.el7",
      "kind": "binary",
      "source": {
        "id": "59",
        "name": "shared-mime-info",
        "version": "1.8-5.el7",
        "kind": "source"
      },
      "arch": "x86_64"
    },
    "256": {
      "id": "256",
      "name": "yum-plugin-fastestmirror",
      "version": "1.1.31-54.el7_8",
      "kind": "binary",
      "source": {
        "id": "105",
        "name": "yum-utils",
        "version": "1.1.31-54.el7_8",
        "kind": "source"
      },
      "arch": "noarch"
    },
    "284": {
      "id": "284",
      "name": "libmount",
      "version": "2.23.2-65.el7_9.1",
      "kind": "binary",
      "source": {
        "id": "119",
        "name": "util-linux",
        "version": "2.23.2-65.el7_9.1",
        "kind": "source"
      },
      "arch": "x86_64"
    },
    [...]
    "144": {
      "id": "144",
      "name": "centos-release",
      "version": "7-9.2009.1.el7.centos",
      "kind": "binary",
      "source": {
        "id": "143",
        "name": "centos-release",
        "version": "7-9.2009.1.el7.centos",
        "kind": "source"
      },
      "arch": "x86_64"
    },
    "270": {
      "id": "270",
      "name": "zlib",
      "version": "1.2.7-20.el7_9",
      "kind": "binary",
      "source": {
        "id": "269",
        "name": "zlib",
        "version": "1.2.7-20.el7_9",
        "kind": "source"
      },
      "arch": "x86_64"
    }
  },
  "distributions": {},
  "repository": {
    "1": {
      "id": "1",
      "name": "pypi",
      "uri": "https://pypi.org/simple"
    }
  },
...
}

[hdonnay]

There's no vulnerability database published for CentOS.