Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Run Grype scan of files given from text file containing filelist #562

Open
tellmemoreaboutit opened this issue Dec 22, 2021 · 2 comments
Open
Labels
enhancement New feature or request multiple-sources Issues that are dependent on supporting multiple sources

Comments

@tellmemoreaboutit
Copy link

What would you like to be added:
Run Grype scan of files given from text file containing file list.

Why is this needed:
When Grype is executed, it scans the pointed directory. However, it would be very useful if Grype has some functionality to scan only files specified in a text file.

Additional context:
Like "grype -i files-to-scan.txt"

files-to-scan.txt:
/etc/directory/file1.jar
/opt/directory/file2.jar
...
/var/directory/filex.jar

Also, JSON output, in this case, should contain an absolute path of the .artifact.locations[].path

@wagoodman wagoodman added the enhancement New feature or request label Dec 22, 2021
@wagoodman
Copy link
Contributor

This seems to highly related to anchore/syft#562 (we try to keep syft and grype aligned in how you express similar actions on the CLI, which is why I'm roping in a syft issue here), where we want to be able to specify multiple inputs (whether they are files, directories, images, etc), and not just a single input.

The current proposal is that this gets surfaced through the CLI as a list of arguments, so for grype:

grype ./path/to/file1 ./path/to/file2 ...

or by application configuration (TBD on final syntax):

input:
 - ./path/to/file1
 - ./path/to/file2

This would allow for more interesting configurations here too, such as mixing of source types:

grype docker:some/image:latest dir:/path/on/my/system file:./manifest.yaml

@spiffcs spiffcs added this to OSS Jun 1, 2022
@spiffcs spiffcs moved this to Triage (Comments or Progress Made) in OSS Jun 1, 2022
@spiffcs spiffcs moved this from Triage (Comments or Progress Made) to Backlog (Pulled Forward for Priority) in OSS Jul 21, 2022
@kzantow kzantow self-assigned this Sep 7, 2022
@spiffcs spiffcs moved this from Backlog (Pulled Forward for Priority) to In Progress (Actively Resolving) in OSS Sep 8, 2022
@kzantow
Copy link
Contributor

kzantow commented Dec 6, 2022

An update: we started working on a way to support this, but ultimately have decided to put this on the back burner for the moment, as there are some blocking challenges. We will revisit this when the roadblocks are no longer impeding progress here.

@kzantow kzantow moved this from In Progress (Actively Resolving) to Parking Lot (Comments or Progress) in OSS Dec 6, 2022
@kzantow kzantow moved this from Parking Lot (Comments or Progress) to Backlog (Pulled Forward for Priority) in OSS Dec 6, 2022
@kzantow kzantow added the multiple-sources Issues that are dependent on supporting multiple sources label Dec 6, 2022
@kzantow kzantow removed their assignment Dec 6, 2022
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
enhancement New feature or request multiple-sources Issues that are dependent on supporting multiple sources
Projects
Status: Backlog
Development

No branches or pull requests

3 participants