#1061720 ITP: grype -- A vulnerability scanner for container images and filesystems

Package:
wnpp
Source:
wnpp
Submitter:
Daniel Echeverri
Date:
2026-01-10 19:43:01 UTC
Severity:
normal
#1061720#5
Date:
2024-01-29 04:53:14 UTC
From:
To:
* Package name : grype
* Version : 0.74.3
* Upstream Author : Anchore, Inc.
* URL or Web page : https://github.com/anchore/grype
* License : ASL-2.0
* Description : A vulnerability scanner for container images and
filesystems.

Scan the contents of a container image or filesystem to find known
vulnerabilities.
Find vulnerabilities for major operating system packages:
- Alpine
- Amazon Linux
- BusyBox
- CentOS
- CBL-Mariner
- Debian
- Distroless
- Oracle Linux
- Red Hat (RHEL)
- Ubuntu
Find vulnerabilities for language-specific packages:
- Ruby (Gems)
- Java (JAR, WAR, EAR, JPI, HPI)
- JavaScript (NPM, Yarn)
- Python (Egg, Wheel, Poetry, requirements.txt/setup.py files)
- Dotnet (deps.json)
- Golang (go.mod)
- PHP (Composer)
- Rust (Cargo)
- Supports Docker, OCI and Singularity image formats.
#1061720#12
Date:
2026-01-07 01:06:27 UTC
From:
To:
Hi Daniel,

I'm currently working on packaging syft (the SBOM generator from Anchore)
and noticed your ITP for grype from January 2024.

Since grype and syft are companion tools (grype uses syft for package
detection), I wanted to check on the status of your packaging effort.

Are you still actively working on grype? If not, would you be open to
me taking over the ITP, or would you prefer to collaborate?

I'm planning to submit syft to mentors soon and having both tools
available would benefit the Debian supply chain security ecosystem.

Best regards,
Juan Méndez
#1061720#17
Date:
2026-01-10 14:06:16 UTC
From:
To:
Hello!

El mar, 6 ene 2026 a la(s) 8:06 p.m., Juan Mendez (vejeta@gmail.com)
escribió:

Thanks for working on that!


No problem, feel free to take over the bug.

When I originally looked into packaging it for Debian, some dependencies
weren’t available in the archive at the time, but things may have changed
since then.

Cheers,
Daniel
#1061720#24
Date:
2026-01-10 19:41:08 UTC
From:
To:
Hi Daniel,

Thanks for letting me know.

I submitted a control command to start working on it.

So far, grype shares more than 90% of  its dependencies with syft.

So my  current plan:
1. Package syft first (~124 missing deps - this is the heavy work)
2. Then grype becomes straightforward (+18 additional deps)

I've prepared the initial gbp repository structure for grype and
will push to salsa.

This is a long-term effort, given the dependency tree, but a good
opportunity to work with a team too.

Best regards,
Juan Manuel Méndez Rey