How can we make Grype's output more focused?

Grype
3

Thanks @maskitron!

It sounds like the goal with this change is to make the output JSON smaller. I wanted to confirm this, because a lot of our discussions were about ideas that would make the standard table output smaller, but would not actually make the JSON smaller (because matches would be moved from the matches key in the JSON to the ignoredMatches key).

I’m going to propose a few changes to Grype. We’ll try discussing these at the next community meeting.

  1. Add a min-severity flag, that takes any severity level (negligible, low, medium, high, or critical) and ignores every severity below that level. So grype --min-severity low my-image would scan the image and ignore negligible severities, grype --min-severity medium would ignore low and negligible, etc.
  2. Change show-suppressed config value to affect JSON output. This value will default to “false” for the table format and “true” for other formats, but will be respected by the presenter of any format.
  3. Change the config file to enable adding an entry like - severity: negligible to the ignore node in Grype’s config file. (You can see a sample of the current file by running grype config).

At the next community meeting (tomorrow) we’ll try to discuss the pros and cons of making this particular change to Grype.

@maskitron for your use case, you would do something like GRYPE_SHOW_SUPPRESS=false GRYPE_MIN_SEVERITY=low grype ... and it would make JSON that includes none of the ignore vulnerabilities. Would that meet your us case?