August 15th | Open Source Gardening | Live Stream

[popey]

August 15th | Open Source Gardening | Live Stream

Every Thursday, the Anchore Open Source team runs a live stream to discuss issues, pull requests and future planning in our SBOM and vulnerability tools.

Starts at 2024-08-15T19:00:00Z for about an hour.

Expect engineering and project management discussions, a bit of GitHub issue gardening on Syft, Grype, and the rest of the family.

Join us today for a relaxed, educational and productive live stream.

15th August | Open Source Gardening | Live with Anchore Devs

Topics

This week we are planning to talk about the issues marked ‘needs-discussion’ in syft and grype

Plus anything else we have time for, and your questions.

[popey]

We ended up discussing the following issues:

Syft

• Missing dependency relationships between direct dependencies and transient dependencies in NPM packages · Issue #3109 · anchore/syft · GitHub
• Wrong CPEs generated for OpenSSL by dotnet cataloguer · Issue #3120 · anchore/syft · GitHub
• Support generating sbom for specific pnpm workspace packages · Issue #2574 · anchore/syft · GitHub
• Dependency graph of BOMs generated with Syft is incomplete due to missing root node · Issue #3071 · anchore/syft · GitHub

Grype

• Filter output by severity · Issue #2006 · anchore/grype · GitHub - discussion continuing at How can we make Grype's output more focused?

We then rolled the and picked up a few for a brief discussion.

• Add option to exclude packages introduced from a base layer · Issue #1809 · anchore/syft · GitHub
• Automatic feedback of scan results as PR comment · Issue #162 · anchore/scan-action · GitHub
• False positive: GHSA-ggxm-pgc9-g7fp (CVE-2021-31799) in SLES 15.5 · Issue #1893 · anchore/grype · GitHub