Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions llms.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# grype-db

Anchore's vulnerability database builder for Grype - transforms upstream vulnerability data into actionable security intelligence.

## Overview

grype-db is a Go-based application that aggregates vulnerability data from multiple upstream sources (NVD, GitHub, Red Hat, etc.) and builds a comprehensive vulnerability database used by Grype vulnerability scanner. It processes various data formats and creates a unified SQLite database with standardized vulnerability information.

## Core Components

### Database Building (`cmd/grype-db/`)
- `main.go` - CLI entry point with commands: build, pull, package, cache
- `cli/commands/` - Command implementations for data operations
- `application/` - Core application logic and configuration

### Data Processing (`pkg/process/`)
- Processors for different vulnerability sources (NVD, GitHub, OS vendors, etc.)
- Schema versioning support (v5, v6) for backward compatibility
- Data transformers for normalizing vulnerability formats

### Provider System (`pkg/provider/`)
- Interfaces for vulnerability data sources
- Vunnel integration for upstream data fetching
- File and SQLite-based data storage

### Database Management (`manager/`)
- Python-based database management utilities
- Distribution and validation tooling
- S3 integration for database publishing

## Key Features

- Multi-source vulnerability aggregation (NVD, GitHub Security Advisories, OS vendors)
- Schema versioning with backward compatibility
- Caching system for efficient data updates
- Database packaging and distribution
- Validation and testing frameworks

## Usage

```bash
# Build database from all sources
grype-db -g

# Build from specific providers
grype-db -g -p nvd,github

# Pull data only
grype-db pull -p nvd

# Package for distribution
grype-db package
```

The tool requires a GitHub token for accessing GitHub Security Advisories and uses vunnel for upstream data management.