Configuring Syft and Grype scans
Overview
With Code Risk Analyzer (CRA) being deprecated, Syft and Grype scans are alternative that provide most of the CRA features.
This scan is part of the compliance checks stage available in the PR (app-preview), CI and CC pipelines.
Syft
Syft is a CLI tool for generating an SBOM from container images and filesystems.
A Software Bill of Materials (SBOM) is a detailed list of all libraries and components that make up software.
To learn more about SBOMs see Software Bill of Materials.
Grype
Grype is a CLI tool for scanning container images, filesystems, and SBOMs for known vulnerabilities.
Vulnerability scanning is the process of identifying known security vulnerabilities in software packages and dependencies.
Enabling and configuring Syft and Grype scans
To enable Syft SBOM generation and Grype SBOM validation, add opt-in-syft-grype as a text property to your pipeline or trigger properties, with a value set to a non-empty string (except 0).
Enabling this feature runs both Syft and Grype scripts triggered from the compliance checks script Commons Scripts Library documentation. The scripts automatically install Syft and Grype if not already present.
Syft parameters
The pipeline environment properties that are listed in the following table are used to customize the Syft SBOM generation.
| Parameter name | Description |
|---|---|
app-name |
Name of the target being analyzed by Syft. This value is used as the source name in the generated SBOM. |
syft-exclude |
Comma-separated list of paths to exclude from SBOM generation. Example: node_modules,test,*.log. |
syft-print-summary-as-table |
Set to any non-empty string to print the Syft scan summary as a table in the log output. |
syft-<XXX> |
Any pipeline or trigger text property prefixed with syft- (except the reserved properties above) is exported as a Syft Configuration Environment variable SYFT_XXX. For example, syft-file-metadata-cataloger-enabled becomes SYFT_FILE_METADATA_CATALOGER_ENABLED. See Syft Configuration for available options. |
Syft evidence and attachments
The DevSecOps pipeline uploads evidence to the locker and includes the evidence in the evidence summary for Change Requests.
| Field | Value |
|---|---|
tool type |
syft |
evidence type |
com.ibm.code_bom_check |
asset type |
repo |
attachments |
syft_sbom.json (CycloneDX JSON format) |
Grype parameters
The pipeline environment properties that are listed in the following table are used to customize the Grype vulnerability scanning.
| Parameter name | Description |
|---|---|
grype-fail-on-severity |
Set the return code to 1 if a vulnerability is found with a severity greater than or equal to the given severity level. Valid values: negligible, low, medium, high, critical.
Default: low. |
grype-<XXX> |
Any pipeline or trigger text property prefixed with grype- (except the reserved properties above) is exported as a Grype Configuration Environment variable GRYPE_XXX. For example, grype-db-auto-update becomes GRYPE_DB_AUTO_UPDATE. See Grype Configuration for available options. |
Grype evidence and attachments
The DevSecOps pipeline uploads evidence to the locker and includes the evidence in the evidence summary for Change Requests. Compliance incidents are created for vulnerabilities found during the scan.
| Field | Value |
|---|---|
tool type |
grype |
evidence type |
com.ibm.code_vulnerability_scan |
asset type |
repo |
attachments |
<repo-key>_grype_report_extended.json (Grype vulnerability report with SBOM dependencies) |
Accessing your scan results
You can access your scan results by using the following method:
- Using the DevSecOps/CoCoa CLI command line tool to download your scan results from the evidence locker by using the information printed in the stage log. For more information, see the following resources: