Hello, friends!
I built something that might be of interest to you, using Syft and Grype. It scans snaps for vulnerabilities. It’s called SnapScope, and you can see it at:
It scans any snap package you specify that is publicly available on the Snap Store. Each publisher has a page where you can view previously scanned snaps, results, and the queue of snaps waiting to be checked.
I made a 5-minute video to show you around:
Feedback and suggestions welcome!
Showing the snap revision, channel, and scan timestamp alongside each result would make comparisons much easier, since publishers can update a snap without changing its name. It’d also be useful to see which Grype database version was used, so someone can tell whether a changed result came from a new snap build or updated vulnerability data.
Adding the snap revision and the Grype database build date would help a lot, since the DB gets updated regularly and a CVE appearing or disappearing may just reflect newer data rather than a rebuilt snap. A small diff view between two scans of the same snap would make that distinction obvious at a glance. Showing the scan timestamp separately from the DB version also matters, because the results a page displays were produced at scan time, not when someone views it.
