grype

Grype is a vulnerability scanner for container images and filesystems, developed by Anchore and released under the Apache-2.0 license. It is designed to detect known vulnerabilities in software artifacts and can be used both as a command-line tool and as part of automated workflows. Key capabilities described in the README: - Scans container images, filesystems, and SBOMs for known vulnerabilities. Supported scan targets are documented separately. - Supports major OS package ecosystems, including Alpine, Debian, Ubuntu, RHEL, Oracle Linux, and Amazon Linux, among others. - Supports language-specific packages such as Ruby, Java, JavaScript, Python, .NET, Go, PHP, and Rust. - Handles Docker, OCI, and Singularity image formats. - Provides threat and risk prioritization using EPSS, KEV, and risk scoring. - Supports OpenVEX for filtering and augmenting scan results. Installation is available through a shell script, with additional methods such as Homebrew, Docker, Chocolatey, and MacPorts referenced in the documentation. Basic usage includes scanning a container image (for example, `grype alpine:latest`), scanning a directory (`grype ./my-project`), or scanning an SBOM (`grype sbom:./sbom.json`), including piping an SBOM into the tool. The project encourages community contributions through issue submissions and code contributions, and provides contributing and developer documentation. Development is sponsored by Anchore. The README also mentions regular community meetings with a public calendar and agenda, and commercial support options are available through Anchore.