grype

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

Grype (Anchore) matches packages against vulnerability data (NVD, GitHub advisories, distro feeds) and shows CVEs with severity and the fixed version. It scans images directly or reads an SBOM from Syft, so you can re-scan old releases quickly when new CVEs come out. --fail-on makes it a CI gate.

طريقة الكتابة

grype SOURCE [--fail-on SEVERITY] [-o FORMAT]

الأجزاء الرئيسية

Sources

IMAGE: Container image.
dir:PATH: A folder.
sbom:FILE: An SBOM (Syft, CycloneDX, SPDX).
db status|update: The vulnerability database.

الخيارات 6

الأكثر استخدامًا

Flags

--fail-on low|medium|high|critical: Exit 1 at this severity or higher.
--only-fixed: Show only CVEs that have a fix.
-o table|json|sarif|cyclonedx|template: Output format.
--file FILE: Write output to a file.
-c FILE: Config file (ignore rules).
--add-cpes-if-none: Better matching for unknown packages.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Scan an image

$grype nginx:1.27
$grype ghcr.io/s0sta/shop:1.4.0 --only-fixed

2CI gate on high and critical

$grype ghcr.io/s0sta/shop:1.4.0 --fail-on high --only-fixed

3Scan an SBOM

$syft ghcr.io/s0sta/shop:1.4.0 -o syft-json=shop.syft.json
$grype sbom:shop.syft.json

4Scan a project folder
```
$grype dir:.
```

5SARIF for GitHub code scanning

$grype dir:. -o sarif --file grype.sarif

6Ignore an accepted finding

$cat .grype.yaml
ignore:
  - vulnerability: CVE-2024-12345
    reason: "not reachable; review 2027-01-31"

7Update and check the database
```
$grype db update
$grype db status
```

8Only critical CVEs as JSON

$grype nginx:1.27 -o json | jq -r '.matches[] | select(.vulnerability.severity=="Critical") | .vulnerability.id' | sort -u

9Use the GitHub Action

$cat .github/workflows/grype.yml
      - uses: anchore/scan-action@v4
        with: { image: "ghcr.io/s0sta/shop:1.4.0", fail-build: true, severity-cutoff: high }

10Compare with Trivy

$trivy image -q --severity CRITICAL ghcr.io/s0sta/shop:1.4.0 | tail -3

انتبه

Different scanners use different data; small differences between Grype and Trivy are normal.

الملفات

~/.cache/grype/db/: Vulnerability database.
.grype.yaml: Project config and ignores.

نصائح للحفظ

Re-scan the SBOMs of all running releases every night.

رموز الخروج

`0`	Success, nothing at or above --fail-on.
`1`	Findings at or above --fail-on, or an error.

`grype`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Sources

الخيارات 6

Flags

أمثلة 10

1Scan an image

2CI gate on high and critical

3Scan an SBOM

4Scan a project folder

5SARIF for GitHub code scanning

6Ignore an accepted finding

7Update and check the database

8Only critical CVEs as JSON

9Use the GitHub Action

10Compare with Trivy

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Sources

الخيارات 6

Flags

أمثلة 10

1Scan an image

2CI gate on high and critical

3Scan an SBOM

4Scan a project folder

5SARIF for GitHub code scanning

6Ignore an accepted finding

7Update and check the database

8Only critical CVEs as JSON

9Use the GitHub Action

10Compare with Trivy

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`grype`