Validate CPEs somehow

sqlite3 -noheader "$(grype db status -o json | jq -r '.path')" \
  "SELECT json_group_array(json_object(
     'vendor', vendor,
     'product', product))
   FROM (
     SELECT DISTINCT
       vendor,
       product
     FROM cpes
     WHERE part = 'a'
     ORDER BY vendor, product
   );" | jq \
  > cpe_min.json

This gives all CPEs grype knows about. It might make sense to store this somewhere so we can lint the CPEs we use. I don't know how good the grype coverage is though.

Start by running the provided grype, sqlite3, and jq command to inspect the available CPE vendor/product data and its coverage. Determine where the project's CPEs are stored and how validation could be integrated; done means the project can lint its CPEs against a maintained data source with coverage limitations understood.