anchore / anchore/grype

Convenient support for db downloads from artifactory.

Open
#2,004 4 comments 0 reactions 0 assignees View on GitHub
database enhancement
Dominant language
Go
Stars
12.9k
Forks
880
Avg merge
3d 6h
Merged PRs (30d)
25

Description

**What would you like to be added**:

Hi,
Thank you for developing the grype tool, it's really great.

I wanted to ask about some feature to support convenient downloads through artifactory proxies, for example JFrog.

I am happy to implement it once the proposal is accepted.

**Constraints**

* Metadata file cannot be rewritten (proxy is just a passthrough), so the urls to specific dbs remain the same.

**Current possible solution**

* Specify the `GRYPE_DB_UPDATE_URL` to download metadata from the proxy.
* url=grype db list | some parsing to get latest db url
* curl url -o out
* grype db import out

**Desired solution**

1. I would like to eliminate the curl step and rely solely on grype calls
3. As a bonus the single `grype db update` call would be sufficient.

**Proposals**

1. Expose a "rewrite" parameter for `grype db update` that would replace the prefix of the url from listing.json. For example: `--rewrite=https://toolbox-data.anchore.io/grype/databases=https://my_proxy.com` would rewrite `https://toolbox-data.anchore.io/grype/databases/vulnerability-db_v5_2024-07-24T01:31:07Z_1721794870.tar.gz` to `https://my_proxy.com/vulnerability-db_v5_2024-07-24T01:31:07Z_1721794870.tar.gz`
* This would allow single `grype db update` call
* Not sure if this is generic enough or targets just my specific problem, looking forward to your feedback.
2. Expose [UpdateTo](https://github.com/anchore/grype/blob/e07546ec8667f7972c8bf826785fed7ebb23950c/grype/db/curator.go#L219) in new or existing commands. Either `grype db updateto` or `grype db update --version=vulnerability-db_v5_2024-07-24T01:31:07Z_1721794870.tar.gz`
* This would allow combining the curl and import into single grype call.

**Why is this needed**:

This is mostly for convenience.

**Additional context**:

Contributor guide

Open the contributing guide

Research direction

Start with grype/db/curator.go at the referenced UpdateTo entry point and trace the grype db update command, GRYPE_DB_UPDATE_URL, and listing.json handling. Compare the proposed URL rewrite and explicit-version workflows, then define a complete grype-only update path for Artifactory proxies and verify it with the database update behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.