grype

CycloneDX tools offer packages for each and every programming language. [1] The dependency track project accumulates all dependency vulnerabilities in a dashboard. [2] Container SBOMs can be generated with syft and grype [3] [4] [1] https://github.com/CycloneDX [2] https://github.com/DependencyTrack [3] https://github.com/anchore/syft [4] https://github.com/anchore/grype

Besides pointing pentester tools like metasploit at yourself, there are some nice scanners out there. Examples in no particular order: https://github.com/quay/clair https://github.com/anchore/grype/ https://github.com/eliasgranderubio/dagda/ https://github.com/aquasecurity/trivy So then you set up something like a cron job to scan everything for you and email the results once a week or whatever if you don't want to monitor things actively.

Hey everyone! I open-sourced a project that finds unsupported/End of Life software in container images, systems, and SBOMs. It's based on https://github.com/anchore/grype and uses https://endoflife.date/ as a data source for EOL packages.

I was also a bit confused and expected something like grype -https://github.com/anchore/grype

Does it include all the VulnDBs integrated into the OSS Anchore / Grype? https://github.com/anchore/anchore https://github.com/anchore/grype

May I suggest you look into grype[0], or some other similar tool? It can be used to scan images for vulnerabilities. You'll probably find a bunch of vulnerabilities that aren't likely to actually affect you, but still, at least you'll know they're in the images you're running. And maybe you'll start using things like docker-slim[1] on your own images to get rid of those vulnerabilities you do find. [0]: https://github.com/anchore/grype [1]: https://github.com/docker-slim/docker-slim

Ed: linked as "infoworld article" in TFA. This article[1] probably seems like a bit of convenient self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed mobile device manager running on windows) and container images. [1] https://www.infoworld.com/article/3644492/how-to-detect-the-... Submitted to hn as: https://news.ycombinator.com/item?id=29543589 in case there's more discussion of tooling that might fit there.

This article probably seems like a bit of convenient self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed mobile device manager running on windows) and container images.

The approach I like to take is to curate issues and PR with semantic titles and organize them by label ("bug", "enhancement", etc) or linking PRs to an already curated issue. This way automation can use these to generate the changlog for me on each release based on closed issues and unlinked PRs since the last release. We wrote Chronicle to do that automation for us: https://github.com/anchore/chronicle . The nice thing about this... since you typically curate issues during the development process anyway, if you're doing that right then you get a nice looking changlog for free! We use this approach with our core tools, Syft and Grype (some changlog examples: https://github.com/anchore/syft/releases/tag/v0.31.0 and https://github.com/anchore/grype/releases/tag/v0.26.1 ). Always happy to hear new feature ideas and possible customizations

Or grype for checking your Docker images: https://github.com/anchore/grype

Anchore provides Grype https://github.com/anchore/grype