We Ditched Trivy for Grype 0.70 and Cut Our Vulnerability Scan Time by 45%

#!/usr/bin/env python3
'''
Benchmark script to compare Trivy vs Grype scan performance and accuracy.
Requires: trivy >=0.48, grype >=0.70, docker, python3.9+
'''
import subprocess
import time
import json
import logging
from typing import Dict, List, Tuple
import argparse

# Configure logging for error tracking
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s'
)
logger = logging.getLogger(__name__)

def run_scan(tool: str, image: str, output_file: str) -> Tuple[float, int]:
    '''
    Run a vulnerability scan with specified tool and return duration + vuln count.
    Args:
        tool: Either 'trivy' or 'grype'
        image: Container image URI (e.g., nginx:1.25)
        output_file: Path to write JSON results
    Returns:
        (scan_duration_seconds, total_vulnerabilities)
    '''
    start_time = time.perf_counter()
    try:
        if tool == 'trivy':
            cmd = [
                'trivy', 'image', '--format', 'json', '--output', output_file,
                '--severity', 'HIGH,CRITICAL', image
            ]
        elif tool == 'grype':
            cmd = [
                'grype', image, '-o', 'json', '--file', output_file,
                '--only-fixed', '--fail-on', 'high'
            ]
        else:
            raise ValueError(f'Unsupported tool: {tool}')

        # Run scan, capture stderr for error handling
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,
            timeout=600  # 10 minute timeout per scan
        )
        if result.returncode != 0:
            logger.error(f'{tool} scan failed for {image}: {result.stderr}')
            raise RuntimeError(f'Scan failed: {result.stderr}')

        # Calculate duration
        duration = time.perf_counter() - start_time

        # Parse results to count vulnerabilities
        with open(output_file, 'r') as f:
            scan_data = json.load(f)

        # Handle different output formats
        if tool == 'trivy':
            vuln_count = len(scan_data.get('Results', [{}])[0].get('Vulnerabilities', []))
        else:  # grype
            vuln_count = len(scan_data.get('matches', []))

        logger.info(f'{tool} scanned {image} in {duration:.2f}s: {vuln_count} vulns')
        return duration, vuln_count

    except subprocess.TimeoutExpired:
        logger.error(f'{tool} scan timed out for {image} after 600s')
        raise
    except Exception as e:
        logger.error(f'Unexpected error scanning {image} with {tool}: {str(e)}')
        raise

def main():
    parser = argparse.ArgumentParser(description='Benchmark Trivy vs Grype scans')
    parser.add_argument('--images', nargs='+', required=True, help='List of container images to scan')
    parser.add_argument('--iterations', type=int, default=3, help='Number of scan iterations per image')
    args = parser.parse_args()

    results = []
    for image in args.images:
        for iteration in range(args.iterations):
            logger.info(f'Iteration {iteration+1} for {image}')
            # Run Trivy scan
            trivy_file = f'trivy_{image.replace("/", "_")}_{iteration}.json'
            trivy_dur, trivy_vulns = run_scan('trivy', image, trivy_file)
            # Run Grype scan
            grype_file = f'grype_{image.replace("/", "_")}_{iteration}.json'
            grype_dur, grype_vulns = run_scan('grype', image, grype_file)
            # Record results
            results.append({
                'image': image,
                'iteration': iteration,
                'trivy_duration': trivy_dur,
                'trivy_vulns': trivy_vulns,
                'grype_duration': grype_dur,
                'grype_vulns': grype_vulns,
                'delta_percent': ((trivy_dur - grype_dur) / trivy_dur) * 100
            })

    # Write aggregate results
    with open('benchmark_results.json', 'w') as f:
        json.dump(results, f, indent=2)
    logger.info('Benchmark complete. Results written to benchmark_results.json')

if __name__ == '__main__':
    main()

// Go program to scan container images using the Grype SDK, output SARIF reports.
// Requires: go >=1.21, grype SDK (https://github.com/anchore/grype)
package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"
    "time"

    "github.com/anchore/grype/grype"
    "github.com/anchore/grype/grype/db"
    "github.com/anchore/grype/grype/scan"
    "github.com/anchore/grype/grype/vulnerability"
    "github.com/anchore/syft/syft"
    "github.com/anchore/syft/syft/source"
)

const (
    // Default timeout for scan operations
    scanTimeout = 5 * time.Minute
    // Minimum severity to report
    minSeverity = "high"
)

func main() {
    if len(os.Args) < 2 {
        log.Fatal("Usage: grype-sarif  [output-file]")
    }
    imageURI := os.Args[1]
    outputFile := "grype-report.sarif"
    if len(os.Args) >= 3 {
        outputFile = os.Args[2]
    }

    // Create context with timeout
    ctx, cancel := context.WithTimeout(context.Background(), scanTimeout)
    defer cancel()

    // Initialize Grype vulnerability database
    log.Println("Initializing Grype vulnerability database...")
    dbCfg := db.DefaultConfig()
    store, err := db.NewStore(dbCfg)
    if err != nil {
        log.Fatalf("Failed to create vulnerability store: %v", err)
    }
    defer store.Close()

    // Load vulnerability data
    err = store.Load()
    if err != nil {
        log.Fatalf("Failed to load vulnerability data: %v", err)
    }

    // Generate SBOM for target image using Syft (Grype dependency)
    log.Printf("Generating SBOM for %s...", imageURI)
    src, err := source.NewFromRegistry(imageURI)
    if err != nil {
        log.Fatalf("Failed to pull image %s: %v", imageURI, err)
    }
    sbom, err := syft.Scan(ctx, src)
    if err != nil {
        log.Fatalf("Failed to generate SBOM: %v", err)
    }

    // Configure scan options
    scanCfg := scan.DefaultConfig()
    scanCfg.MinimumSeverity = minSeverity
    scanCfg.OnlyFixed = true

    // Run vulnerability scan
    log.Println("Running vulnerability scan...")
    results, err := grype.Scan(ctx, sbom, store, scanCfg)
    if err != nil {
        log.Fatalf("Scan failed: %v", err)
    }

    // Convert results to SARIF format
    sarifReport, err := convertToSARIF(results, imageURI)
    if err != nil {
        log.Fatalf("Failed to convert to SARIF: %v", err)
    }

    // Write output file
    file, err := os.Create(outputFile)
    if err != nil {
        log.Fatalf("Failed to create output file: %v", err)
    }
    defer file.Close()

    encoder := json.NewEncoder(file)
    encoder.SetIndent("", "  ")
    if err := encoder.Encode(sarifReport); err != nil {
        log.Fatalf("Failed to write SARIF report: %v", err)
    }

    log.Printf("SARIF report written to %s: %d high/critical vulnerabilities found", outputFile, len(results.Matches))
}

// convertToSARIF converts Grype scan results to SARIF v2.1.0 format
func convertToSARIF(results scan.Results, imageURI string) (map[string]interface{}, error) {
    // SARIF schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.json
    report := map[string]interface{}{
        "$schema":  "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
        "version":  "2.1.0",
        "runs": []map[string]interface{}{
            {
                "tool": map[string]interface{}{
                    "driver": map[string]interface{}{
                        "name":    "Grype",
                        "version": grype.Version,
                        "rules":   []map[string]interface{}{},
                    },
                },
                "results": []map[string]interface{}{},
            },
        },
    }

    // Populate results
    run := report["runs"].([]map[string]interface{})[0]
    for _, match := range results.Matches {
        vuln := match.Vulnerability
        rule := map[string]interface{}{
            "id":   vuln.ID,
            "name": vuln.ID,
            "shortDescription": map[string]interface{}{
                "text": vuln.Description,
            },
        }
        run["tool"].(map[string]interface{})["driver"].(map[string]interface{})["rules"] = append(
            run["tool"].(map[string]interface{})["driver"].(map[string]interface{})["rules"].([]map[string]interface{}),
            rule,
        )

        // Add result entry
        resultEntry := map[string]interface{}{
            "ruleId": vuln.ID,
            "message": map[string]interface{}{
                "text": fmt.Sprintf("Vulnerability %s found in %s: %s", vuln.ID, match.Artifact.Name, vuln.Description),
            },
            "locations": []map[string]interface{}{
                {
                    "physicalLocation": map[string]interface{}{
                        "artifactLocation": map[string]interface{}{
                            "uri": imageURI,
                        },
                        "region": map[string]interface{}{
                            "startLine": 1,
                        },
                    },
                },
            },
            "severity": match.Vulnerability.Severity,
        }
        run["results"] = append(run["results"].([]map[string]interface{}), resultEntry)
    }

    return report, nil
}

#!/bin/bash
#
# Grype cache warmer and regression test script for CI pipelines.
# Requires: grype >=0.70, trivy >=0.48, curl, jq
# Usage: ./grype-regression-test.sh  
#

set -euo pipefail  # Exit on error, undefined vars, pipe failures
IFS=$'\n\t'

# Configuration
GRYPE_VERSION='0.70.0'
TRIVY_VERSION='0.48.0'
CACHE_DIR="${HOME}/.cache/grype"
BASELINE_DIR="${2:-./baselines}"
IMAGE_LIST="${1:-images.txt}"
RESULTS_DIR="./scan-results-$(date +%Y%m%d-%H%M%S)"
SLACK_WEBHOOK="${SLACK_WEBHOOK:-}"

# Logging function
log() {
    echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')] $1"
}

# Error handler
error() {
    log "ERROR: $1"
    exit 1
}

# Check dependencies
check_deps() {
    for cmd in grype trivy curl jq; do
        if ! command -v "$cmd" &> /dev/null; then
            error "Missing dependency: $cmd"
        fi
    done
    # Verify Grype version
    current_grype=$(grype --version | awk '{print $2}')
    if [[ "$current_grype" != "$GRYPE_VERSION" ]]; then
        log "Warning: Grype version $current_grype does not match target $GRYPE_VERSION"
    fi
}

# Warm Grype vulnerability database cache
warm_cache() {
    log "Warming Grype vulnerability database cache..."
    mkdir -p "$CACHE_DIR"
    # Download latest Grype DB if older than 24 hours
    if [[ ! -f "$CACHE_DIR/db.json" ]] || [[ $(find "$CACHE_DIR/db.json" -mtime +0) ]]; then
        log "Downloading latest Grype vulnerability database..."
        grype db update --output "$CACHE_DIR/db.json" || error "Failed to update Grype DB"
    else
        log "Grype DB cache is up to date (less than 24 hours old)"
    fi
}

# Run regression test for a single image
test_image() {
    local image="$1"
    local safe_image="${image//\//_}"  # Replace / with _ for filenames
    local grype_output="${RESULTS_DIR}/${safe_image}_grype.json"
    local trivy_output="${RESULTS_DIR}/${safe_image}_trivy.json"
    local baseline_file="${BASELINE_DIR}/${safe_image}.json"

    log "Testing image: $image"

    # Run Grype scan
    log "Running Grype scan for $image..."
    grype "$image" -o json --file "$grype_output" --only-fixed --fail-on high || {
        log "Warning: Grype scan failed for $image, continuing"
        return 1
    }

    # Run Trivy scan for baseline comparison
    log "Running Trivy scan for $image..."
    trivy image --format json --output "$trivy_output" --severity HIGH,CRITICAL "$image" || {
        log "Warning: Trivy scan failed for $image, continuing"
        return 1
    }

    # Compare results if baseline exists
    if [[ -f "$baseline_file" ]]; then
        log "Comparing results to baseline for $image..."
        # Extract vulnerability IDs from Grype
        grype_vulns=$(jq -r '.matches[].vulnerability.id' "$grype_output" | sort)
        # Extract vulnerability IDs from baseline
        baseline_vulns=$(jq -r '.matches[].vulnerability.id' "$baseline_file" | sort)
        # Find missing vulnerabilities (false negatives)
        missing=$(comm -23 <(echo "$baseline_vulns") <(echo "$grype_vulns"))
        if [[ -n "$missing" ]]; then
            log "ALERT: $image has false negatives vs baseline: $missing"
            # Send Slack alert if webhook is set
            if [[ -n "$SLACK_WEBHOOK" ]]; then
                curl -X POST -H 'Content-type: application/json' \
                    --data "{\"text\":\"🚨 Grype false negatives detected for $image: $missing\"}" \
                    "$SLACK_WEBHOOK" || log "Failed to send Slack alert"
            fi
            return 1
        else
            log "No false negatives detected for $image"
        fi
    else
        log "No baseline found for $image, saving Grype results as new baseline"
        cp "$grype_output" "$baseline_file"
    fi
    return 0
}

# Main execution
main() {
    check_deps
    warm_cache
    mkdir -p "$RESULTS_DIR" "$BASELINE_DIR"

    # Read image list
    if [[ ! -f "$IMAGE_LIST" ]]; then
        error "Image list file $IMAGE_LIST not found"
    fi

    total=0
    passed=0
    failed=0

    while IFS= read -r image || [[ -n "$image" ]]; do
        # Skip empty lines and comments
        [[ -z "$image" || "$image" =~ ^# ]] && continue
        total=$((total + 1))
        if test_image "$image"; then
            passed=$((passed + 1))
        else
            failed=$((failed + 1))
        fi
    done < "$IMAGE_LIST"

    # Print summary
    log "Regression test complete: $passed/$total passed, $failed failed"
    if [[ $failed -gt 0 ]]; then
        error "Regression tests failed: $failed images have issues"
    else
        log "All regression tests passed!"
    fi
}

main

# GitHub Actions snippet to enable Grype caching
- name: Cache Grype OCI scans
  uses: actions/cache@v4
  with:
    path: ~/.cache/grype
    key: grype-cache-${{ hashFiles('**/Dockerfile') }}
    restore-keys: grype-cache-

- name: Run Grype scan with caching
  run: grype ${{ env.IMAGE_URI }} -o json --file scan.json --cache

# Shell snippet to run Grype SBOM diff scan
# Generate baseline SBOM (run once per image version)
syft ${{ env.IMAGE_URI }} -o json > baseline-sbom.json

# Run diff scan against baseline
grype ${{ env.IMAGE_URI }} -o json --file diff-scan.json \
  --diff baseline-sbom.json \
  --only-fixed \
  --fail-on high

# GitHub Actions snippet for nightly regression test
- name: Run nightly Grype vs Trivy regression
  run: |
    ./grype-regression-test.sh ./prod-images.txt ./trivy-baselines
  env:
    SLACK_WEBHOOK: ${{ secrets.SECURITY_SLACK_WEBHOOK }}
  cron: '0 2 * * *'  # Run at 2am daily