#go #containers #cyclonedx #docker #golang #hacktoberfest #oci #sbom #spdx #static_analysis #tool

https://github.com/anchore/syft

#go #container_image #containers #cyclonedx #docker #golang #hacktoberfest #oci #security #static_analysis #tool #vulnerabilities #vulnerability

https://github.com/anchore/grype

#kotlin #compliance #copyright #copyright_scan #cyclonedx #dependencies #dependency_graph #hacktoberfest #license #license_checking #license_management #license_scan #open_source_licensing #ospo #oss_compliance #package_manager #package_scan #sbom #sbom_generator #sca #spdx

https://github.com/oss-review-toolkit/ort

#go #container_image #containers #cyclonedx #docker #go #golang #hacktoberfest #oci #openvex #security #static_analysis #tool #vex #vulnerabilities #vulnerability

Grype is a tool that scans container images and filesystems for known vulnerabilities. It supports various package types, including those from major operating systems like Alpine, Debian, and Ubuntu, as well as language-specific packages like Ruby, Java, JavaScript, Python, and more. Here’s how it benefits you You can easily install Grype using a simple script or through package managers like Homebrew or Chocolatey.
- **Comprehensive Scanning** You can choose from different output formats such as table, JSON, CycloneDX, and SARIF, or even create custom templates.
- **Integration with Other Tools** Grype has active community meetings and support options, including commercial support through Anchore.
- **Automatic Database Updates**: Grype manages its vulnerability database automatically, ensuring you always have the latest vulnerability information.

Overall, Grype helps you identify and manage vulnerabilities in your container images and filesystems efficiently.

https://github.com/anchore/grype

#go #containers #cyclonedx #docker #go #golang #hacktoberfest #oci #sbom #spdx #static_analysis #tool

Syft is a tool that helps create a list of all the software components used in your applications, known as a Software Bill of Materials (SBOM). This list is important for finding vulnerabilities and ensuring that your software complies with licensing rules. By using Syft, you can better manage your software's security and compliance. It works with many types of software and can be used with other tools like Grype to check for vulnerabilities. This helps keep your software safe and up-to-date.

https://github.com/anchore/syft