anchore / anchore/grype

Add DB namespaces to the JSON descriptor block

Open
#641 0 comments 0 reactions 0 assignees View on GitHub
enhancement I/O
Dominant language
Go
Stars
12.9k
Forks
883
Avg merge
3d 6h
Merged PRs (30d)
25

Description

Similar to https://github.com/anchore/grype/issues/356 , it would be good to get more visibility out of what kind of data was used to match against the input SBOM/image. Specifically, having the list of DB namespaces present when doing the matching would go a long way for custom databases that may have additional namespace values to indicate that they were at least present during the search. In this way the static document output by grype could definitively report the presence of these namespaces instead of needing to find the specific DB blob and analyze it yourself. This is also useful when the DB blob is inaccessible or deleted.

Contributor guide

Open the contributing guide

Research direction

Review the related Grype issue #356, then trace how the JSON descriptor is produced during SBOM or image matching and where database metadata is available. The work is done when static JSON output reports all database namespaces present during matching, including custom namespaces, without requiring access to the database blob.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.