Include references back to Syft

Signed-off-by: Dan Luhring <dan.luhring@anchore.com>
This commit is contained in:
Dan Luhring 2021-05-06 14:20:03 -04:00
parent eb41d80285
commit 8e153c9120
No known key found for this signature in database
GPG key ID: 9CEE23D079426CEF

View file

@ -7,7 +7,7 @@
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/anchore/grype/blob/main/LICENSE)
[![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/anchore/grype.svg)](https://github.com/anchore/grype)
A vulnerability scanner for container images and filesystems. [Easily install the binary](#installation) to try it out.
A vulnerability scanner for container images and filesystems. [Easily install the binary](#installation) to try it out. Works with [Syft](https://github.com/anchore/syft), the powerful SBOM tool for container images and filesystems.
![grype-demo](https://user-images.githubusercontent.com/590471/90276236-9868f300-de31-11ea-8068-4268b6b68529.gif)
@ -55,6 +55,19 @@ grype path/to/image.tar
grype dir:path/to/dir
```
Use [Syft](https://github.com/anchore/syft) SBOMs for even faster vulnerability scanning in Grype:
```
# Just need to generate the SBOM once
syft <image> -o json > ./image-sbom.json
# Then scan for new vulnerabilities as frequently as needed
grype sbom:./image-sbom.json
# (You can also pipe the SBOM into Grype)
cat ./image-sbom.json | grype
```
Sources can be explicitly provided with a scheme:
```
docker:yourrepo/yourimage:tag use images from the Docker daemon
@ -221,7 +234,4 @@ log:
The following areas of potential development are currently being investigated:
- Support for allowlist, package mapping
- Establish a stable interchange format w/Syft
- Accept SBOM (CycloneDX, Syft) as input instead of image/directory
- Accept alternative SBOM formats (CycloneDX, SPDX) as input