Syft & Grype security tools

[popey]

Hello!

I'm here from the Syft, Grype, and Grant projects to request inclusion in Insights, please. We have some well-loved, high-profile OSS projects, supported by a broader ecosystem of tools and libraries.

If this is too many repos to request inclusion, then perhaps just the 'headline' tools at the top of the list.

Primary tools

• https://github.com/anchore/syft - SBOM Generator
• https://github.com/anchore/grype - Vulnerability Scanner
• https://github.com/anchore/grant - License Checker

GitHub Actions

• https://github.com/anchore/sbom-action - GitHub Action to generate SBOMs
• https://github.com/anchore/scan-action - GitHub Action to scan for vulnerabilities

Vuln DB Support tools

• https://gtihub.com/anchore/grype-db - Builds and publishes the Vuln DB for Grype
• https://github.com/anchore/vunnel - Gathers Vuln data from numerous feeds
• https://github.com/anchore/vulnerability-data-tools - Tools for processing Vuln data
• https://github.com/anchore/nvd-data-overrides - Supplemental NVD Vuln data
• https://github.com/anchore/cve-data-enrichment - Supplemental CVE Vuln data

Other misc tools

• https://github.com/anchore/yardstick - Vulnerability scanner comparator
• https://github.com/anchore/quill - Cross platform mac binary signing utility
• https://github.com/anchore/binny - Manage a directory of binaries without a package manager
• https://github.com/anchore/chronicle - Changelog generator sourced from PRs and Issues

Libraries

• https://github.com/anchore/stereoscope - Processing container images and simulating squash filesystems

Thanks for the consideration!