grype
Matches a local SBOM, directory, or image against known vulnerabilities. Point it at an SBOM you generated yourself rather than using it as a live test against a program.
Tags: sbom, dependencies, anchore
- Category
- vuln
- Maintenance signal
- active
Use this when: CI and dependency trust. Does a pull request workflow run untrusted code with the base repository's secrets, or does a package name resolve to an owner the build did not pin?
Install
script
curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/binbrew
brew install grypeCommand templates
Scan a local SBOM
grype sbom:{file}