SBOM scanning using grype wrapped in a convenient REST API.
This allows for a centralised install of grype which will sync the vulnerabiltiy DB periodically instead of requiring all clients to have access to the internet and the bandwidth to download the vulnerability DB.
docker run -d -p 9991:9991 --name grype-server <registry-name>/grype-server run --log-level info
curl -X POST http://<ip>:9991/scanSBOM --data-binary @- <<'EOF'
{
"sbom": "<base 64 encoded SBOM>"
}
EOF
NOTE
Supported SBOM formats include CycloneDX XML and JSON, SPDX and Syft.
If you are ready to jump in and test, add code, or help with documentation, please follow the instructions on our contributing guide for details on how to open issues, setup VMClarity for development and test.
You can view our code of conduct here.