grype

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

Grype (Anchore) matches packages against vulnerability data (NVD, GitHub advisories, distro feeds) and shows CVEs with severity and the fixed version. It scans images directly or reads an SBOM from Syft, so you can re-scan old releases quickly when new CVEs come out. --fail-on makes it a CI gate.

Zo schrijf je het

grype SOURCE [--fail-on SEVERITY] [-o FORMAT]

Belangrijkste delen

Sources

IMAGE: Container image.
dir:PATH: A folder.
sbom:FILE: An SBOM (Syft, CycloneDX, SPDX).
db status|update: The vulnerability database.

Opties 6

Meest gebruikt

Flags

--fail-on low|medium|high|critical: Exit 1 at this severity or higher.
--only-fixed: Show only CVEs that have a fix.
-o table|json|sarif|cyclonedx|template: Output format.
--file FILE: Write output to a file.
-c FILE: Config file (ignore rules).
--add-cpes-if-none: Better matching for unknown packages.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

1Scan an image

$grype nginx:1.27
$grype ghcr.io/s0sta/shop:1.4.0 --only-fixed

2CI gate on high and critical

$grype ghcr.io/s0sta/shop:1.4.0 --fail-on high --only-fixed

3Scan an SBOM

$syft ghcr.io/s0sta/shop:1.4.0 -o syft-json=shop.syft.json
$grype sbom:shop.syft.json

4Scan a project folder
```
$grype dir:.
```

5SARIF for GitHub code scanning

$grype dir:. -o sarif --file grype.sarif

6Ignore an accepted finding

$cat .grype.yaml
ignore:
  - vulnerability: CVE-2024-12345
    reason: "not reachable; review 2027-01-31"

7Update and check the database
```
$grype db update
$grype db status
```

8Only critical CVEs as JSON

$grype nginx:1.27 -o json | jq -r '.matches[] | select(.vulnerability.severity=="Critical") | .vulnerability.id' | sort -u

9Use the GitHub Action

$cat .github/workflows/grype.yml
      - uses: anchore/scan-action@v4
        with: { image: "ghcr.io/s0sta/shop:1.4.0", fail-build: true, severity-cutoff: high }

10Compare with Trivy

$trivy image -q --severity CRITICAL ghcr.io/s0sta/shop:1.4.0 | tail -3

Let op

Different scanners use different data; small differences between Grype and Trivy are normal.

Bestanden

~/.cache/grype/db/: Vulnerability database.
.grype.yaml: Project config and ignores.

Tips om te onthouden

Re-scan the SBOMs of all running releases every night.

Exitcodes

`0`	Success, nothing at or above --fail-on.
`1`	Findings at or above --fail-on, or an error.

`grype`

Wat het doet

Zo schrijf je het

Belangrijkste delen

Sources

Opties 6

Flags

Voorbeelden 10

1Scan an image

2CI gate on high and critical

3Scan an SBOM

4Scan a project folder

5SARIF for GitHub code scanning

6Ignore an accepted finding

7Update and check the database

8Only critical CVEs as JSON

9Use the GitHub Action

10Compare with Trivy

Let op

Bestanden

Tips om te onthouden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Belangrijkste delen

Sources

Opties 6

Flags

Voorbeelden 10

1Scan an image

2CI gate on high and critical

3Scan an SBOM

4Scan a project folder

5SARIF for GitHub code scanning

6Ignore an accepted finding

7Update and check the database

8Only critical CVEs as JSON

9Use the GitHub Action

10Compare with Trivy

Let op

Bestanden

Tips om te onthouden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Volledige handleiding

`grype`