November 14th | Open Source Gardening | Live Stream

[popey]

Hello everyone!

Almost every Thursday, the Anchore Open Source team runs a live stream to discuss issues, pull requests and future planning in our SBOM and vulnerability tools.

Starts at 2024-11-14T20:00:00Z for about an hour.

Expect engineering and project management discussions, a bit of GitHub issue gardening on Syft, Grype, and the rest of the family.

Join us today for a relaxed, educational and spooky live stream.

14th November | Open Source Gardening | Live with Anchore Devs

If you’d like to join us on the Zoom call to discuss any relevant topics, DM me right here in Discourse for the link.

Topics

• Updates - If there’s any important news about the tools, we’ll usually start there.
• Needs discussion - issues and pull requests marked ‘needs-discussion’.
• Any other issues or pulls that need our collective brains
• Questions from the audience

Here’s some handy repo-specific links:

• ND = Marked “Needs discussion”
• Open = All other issues and PRs that are open

(number is quantity at time of posting)

Project	Issues (ND)	PRs (ND)	Issues (Open)	PRs (Open)
syft	15	0	373	36
grype	14	0	263	15
grant	0	0	17	0
sbom-action	0	0	11	3
scan-action	0	0	18	2
grype-db	0	0	13	3
vunnel	0	0	29	10
quill	0	0	12	4

[popey]

Things we discussed:

• 00:03 - Upload SBOM directly to OCI registry · Issue #592 · anchore/syft · GitHub
• 00:32 - Fix: still warn on zero verbosity by willmurphyscode · Pull Request #68 · anchore/clio · GitHub
• 00:39 - Question: Where does the name “Syft” come from?
• 00:41 - add native support for flatpak and snap images · Issue #1088 · anchore/syft · GitHub
• 00:49 - some non-PEP440 version constraints for GHSA python packages in grype-db · Issue #2229 · anchore/grype · GitHub