From 9b253319bae0145343dc680519499df7666732a7 Mon Sep 17 00:00:00 2001 From: kema-dev Date: Fri, 17 Jan 2025 21:48:11 +0100 Subject: [PATCH 1/2] docs(config): add GRYPE_CONFIG docs Signed-off-by: kema-dev --- README.md | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index f6ec1c09e75..5e34632a22c 100644 --- a/README.md +++ b/README.md @@ -420,16 +420,16 @@ If you want Grype to only report vulnerabilities **that do not have a confirmed ## VEX Support Grype can use VEX (Vulnerability Exploitability Exchange) data to filter false -positives or provide additional context, augmenting matches. When scanning a -container image, you can use the `--vex` flag to point to one or more +positives or provide additional context, augmenting matches. When scanning a +container image, you can use the `--vex` flag to point to one or more [OpenVEX](https://github.com/openvex) documents. VEX statements relate a product (a container image), a vulnerability, and a VEX status to express an assertion of the vulnerability's impact. There are four -[VEX statuses](https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-labels): +[VEX statuses](https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-labels): `not_affected`, `affected`, `fixed` and `under_investigation`. -Here is an example of a simple OpenVEX document. (tip: use +Here is an example of a simple OpenVEX document. (tip: use [`vexctl`](https://github.com/openvex/vexctl) to generate your own documents). ```json @@ -466,10 +466,10 @@ Any matches ignored as a result of VEX statements are flagged when using `--show-suppressed`: ``` -libcrypto3 3.0.8-r3 3.0.8-r4 apk CVE-2023-1255 Medium (suppressed by VEX) +libcrypto3 3.0.8-r3 3.0.8-r4 apk CVE-2023-1255 Medium (suppressed by VEX) ``` -Statements with an `affected` or `under_investigation` status will only be +Statements with an `affected` or `under_investigation` status will only be considered to augment the result set when specifically requested using the `GRYPE_VEX_ADD` environment variable or in a configuration file. @@ -673,10 +673,13 @@ Default configuration search paths (see all with `grype config locations`): Use `grype config` to print a sample config file to stdout. Use `grype config --load` to print the current config after loading all values to stdout. -You can specify files directly using the `--config` / `-c` flags to provide your own configuration files/paths: +You can specify files directly using the environment variable `GRYPE_CONFIG` or the `--config` / `-c` flags to provide your own configuration files/paths: -``` +```shell +# Using the flag grype -c /path/to/config.yaml +# Or using the environment variable +GRYPE_CONFIG=/path/to/config.yaml grype ``` Configuration options (example values are the default): @@ -846,7 +849,7 @@ log: file: "" match: - # sets the matchers below to use cpes when trying to find + # sets the matchers below to use cpes when trying to find # vulnerability matches. The stock matcher is the default # when no primary matcher can be identified. java: @@ -879,5 +882,3 @@ The following areas of potential development are currently being investigated: ## Grype Logo

Grype Logo by Anchore is licensed under CC BY 4.0

- - From 2a1a25bfd4fa47a9784a104dfc8b1f6b789d2bfe Mon Sep 17 00:00:00 2001 From: kema Date: Tue, 21 Jan 2025 17:46:53 +0100 Subject: [PATCH 2/2] docs(readme): make config option clearer Signed-off-by: kema --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5e34632a22c..d6d0520dd5e 100644 --- a/README.md +++ b/README.md @@ -673,7 +673,7 @@ Default configuration search paths (see all with `grype config locations`): Use `grype config` to print a sample config file to stdout. Use `grype config --load` to print the current config after loading all values to stdout. -You can specify files directly using the environment variable `GRYPE_CONFIG` or the `--config` / `-c` flags to provide your own configuration files/paths: +You can specify files directly using the `--config` / `-c` flags (or environment variable `GRYPE_CONFIG`) to provide your own configuration files/paths: ```shell # Using the flag