Convenient support for db downloads from artifactory.
- Dominant language
- Go
- Stars
- 12.9k
- Forks
- 880
- Avg merge
- 3d 6h
- Merged PRs (30d)
- 25
Description
**What would you like to be added**:
Hi,
Thank you for developing the grype tool, it's really great.
I wanted to ask about some feature to support convenient downloads through artifactory proxies, for example JFrog.
I am happy to implement it once the proposal is accepted.
**Constraints**
* Metadata file cannot be rewritten (proxy is just a passthrough), so the urls to specific dbs remain the same.
**Current possible solution**
* Specify the `GRYPE_DB_UPDATE_URL` to download metadata from the proxy.
* url=grype db list | some parsing to get latest db url
* curl url -o out
* grype db import out
**Desired solution**
1. I would like to eliminate the curl step and rely solely on grype calls
3. As a bonus the single `grype db update` call would be sufficient.
**Proposals**
1. Expose a "rewrite" parameter for `grype db update` that would replace the prefix of the url from listing.json. For example: `--rewrite=https://toolbox-data.anchore.io/grype/databases=https://my_proxy.com` would rewrite `https://toolbox-data.anchore.io/grype/databases/vulnerability-db_v5_2024-07-24T01:31:07Z_1721794870.tar.gz` to `https://my_proxy.com/vulnerability-db_v5_2024-07-24T01:31:07Z_1721794870.tar.gz`
* This would allow single `grype db update` call
* Not sure if this is generic enough or targets just my specific problem, looking forward to your feedback.
2. Expose [UpdateTo](https://github.com/anchore/grype/blob/e07546ec8667f7972c8bf826785fed7ebb23950c/grype/db/curator.go#L219) in new or existing commands. Either `grype db updateto` or `grype db update --version=vulnerability-db_v5_2024-07-24T01:31:07Z_1721794870.tar.gz`
* This would allow combining the curl and import into single grype call.
**Why is this needed**:
This is mostly for convenience.
**Additional context**:
Contributor guide
Research direction
Start with grype/db/curator.go at the referenced UpdateTo entry point and trace the grype db update command, GRYPE_DB_UPDATE_URL, and listing.json handling. Compare the proposed URL rewrite and explicit-version workflows, then define a complete grype-only update path for Artifactory proxies and verify it with the database update behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100