Implementing package vulnerability assessment for microcontainers

A computer program product comprising:

• one or more non-transitory computer-readable storage devices and program instructions stored on at least one of the one or more non-transitory storage devices, the program instructions executable by a processor, the program instructions comprising sets of instructions for:
• receiving the first version of the software package comprising one or more files;
• receiving the second version of the software package comprising one or more files that correspond to the files in the first version;
• identifying a changed file in the first version of the software package that is different from a corresponding file in the second version of the software package;
• identifying a container file in an application container that matches the changed file in the first version of the software package, wherein the application container is a microcontainer that does not include a package manager;
• and
• displaying a container vulnerability report that associates the identified container file with the vulnerability.

A computer-implemented method comprising:

• receiving a package-level report associating a first version of a software package with a vulnerability and a second version of the software package as being an update that fixes the vulnerability;
• receiving the first version of the software package comprising one or more files;
• receiving the second version of the software package comprising one or more files that correspond to the files in the first version;
• identifying a changed file in the first version of the software package that is different from a corresponding file in the second version of the software package;
• identifying a container file in an application container that matches the changed file in the first version of the software package, wherein the application container is a microcontainer that does not include a package manager;
• and
• displaying a container vulnerability report that associates the identified container file with the vulnerability at a display device.