[FEATURE] add `json` format to cves command
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
Research direction
Start with the cves command and inspect the existing sbom and sarif output formats to find where vulnerability and image data are assembled. Add a machine-readable json format containing the requested package fields and image OS, version, and architecture, then verify its output against the stated requirements.
Written by the indexing model from the issue text.
Description
Currently, there is no machine-readable output format for the cves command that supports listing both the architecture of the image and the fixed_in version of the vulnerability.
While this information is available separately in different formats—for example, architecture is included in the sbom format and fixed_in is available in the sarif format—there is no single format that provides both.
I propose adding a new json output format that includes both fields. This is not a new requirement; tools like Grype and Trivy already support formats that include this information. Even Docker Scout has a packages format that provides these details, although it is in a pretty-printed format and not machine-readable.
Implementing this should not be difficult, as the information is already available internally.
The following are the basic requirements that are expected in a single format:
- vuln_package
- name
- installedVersion
- fixedVersion
- vulnerabilityID
- image:
- os_type
- os_version
- os_arch
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/scout-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
allstar
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
panic: nil deref in createVCS() scanning multi-arch image by tag when no attestation sidecar exists Open
Difficulty 4/5 3-5 days Newbie friendliness 64/100
All issues in docker/scout-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
technical-debt
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
ll7/robot_sf_ll7#9560 ·
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100