DependencyTrack / DependencyTrack/dependency-track

Evaluate grype-db as source for vulnerability database

Open
#4,527 0 comments 0 reactions 0 assignees View on GitHub
help wanted size/M spike / research
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We're aiming to build a mechanism to assemble and distribute a vulnerability database tailored to Dependency-Track's needs.

Similar efforts exist already. It would be good to leverage what is already there, rather than reinventing the wheel.

The goals for our own database are defined here: https://docs.google.com/document/d/1DVV4ik7NGOBc6u-fdPlPVKoplNmSpzDT6iC4FJAFYi0/edit?tab=t.0#heading=h.w22q0gsagz1c

### Proposed Behavior

Evaluate if and how grype-db (https://github.com/anchore/grype-db) can be leveraged.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.