anchore / grype

A vulnerability scanner for container images and filesystems
Apache License 2.0
8.71k stars 571 forks source link

Top level `output` config should only affect grype root command #2025

Open willmurphyscode opened 3 months ago

willmurphyscode commented 3 months ago

What happened:

If output: [json] (or any other list, including an empty list) is present in the config file, grype db list fails with an error.

What you expected to happen:

Not to fail with an error.

How to reproduce it (as minimally and precisely as possible):

cd $(mktemp -d)
echo 'output: [json]' >> .grype.yaml
grype apline:latest
grype db list

You'll see that grype alpine:latest works correctly and prints JSON to stdout, but grype db list fails in the following way:

$ grype db list
invalid application config: 1 error(s) decoding:

* 'output' expected type 'string', got unconvertible type '[]interface {}', value: '[json]'

Anything else we need to know?:

Environment:

willmurphyscode commented 3 months ago

I think what we plan to do here is demote the output of grype db list to be under db, so you'd have like:

db:
    list-output: json
...

or something. It's important that the behavior of the top level output key remain unchanged. In other words, break the config relative to the minor commands db list and not the main command.