Skill UI

Grype is an open-source vulnerability scanner designed by Anchore. It inspects container images, filesystems, and SBOMs for known Common Vulnerabilities and Exposures (CVEs). By leveraging Syft-generated SBOMs, it cross-references package vulnerabilities against major sources like NVD and GitHub Advisories. It is essential for security assessments, supply chain integrity checks, and integrating security into CI/CD pipelines.

This comprehensive guide covers the process of creating, analyzing, and securing Software Bills of Materials (SBOMs). It utilizes Syft to generate standards-compliant SBOMs (CycloneDX or SPDX) from container images and filesystems. The workflow details correlating these SBOMs with known CVEs using Grype for vulnerability analysis, and subsequently signing the artifacts with Cosign. This process is crucial for establishing supply chain trust, ensuring dependency visibility, and integrating vulnerability gating into CI/CD pipelines.