Scan reports and VEX

A stored file's scan

Show what Relic Scan found in a stored file:

relic security report libs-local/org/app/1.0/app.jar

With --fail-on, exit with status 1 when a finding or risk is that severe or worse, or while the scan is queued, unavailable (Relic Scan is off) or has failed:

relic security report charts/demo-0.1.0.tgz --fail-on high

For an image tag folder, the report shows the tag manifest's scan:

relic security report docker-local/team/app/1.4.0 -o json

Operational risks

List end-of-life, deprecated or unmaintained components:

relic security risks

List one kind in one repository:

relic security risks --kind end_of_life --repository libs-local -o json

SBOMs

Write an item's SBOM as CycloneDX, SPDX or Syft JSON:

relic security sbom export libs-local/app/app-1.4.0.jar --format cyclonedx > app.cdx.json

Replace an item's SBOM with your own:

relic security sbom import libs-local/app/app-1.4.0.jar build/bom.json

For an image, give its folder (docker-local/web/1.2).

VEX

Export the ignore rules as OpenVEX not_affected statements:

relic security vex export > relic.vex.json

Export CycloneDX, adding Go vulnerabilities no code calls:

relic security vex export --format cyclonedx --unreachable --file relic.cdx.json

Import an OpenVEX or CycloneDX document's not_affected and fixed (resolved) statements as ignore rules (administrators). A statement whose rule is already stored (the same vulnerabilities, packages and other filters) creates no new rule, so importing a document again changes nothing:

relic security vex import vendor.vex.json

The vulnerability database

Import the vulnerability database offline:

relic security database import grype-db.tar.zst

Show its state:

relic security database status

End-of-life data

Import endoflife.date data offline:

relic security end-of-life import eol.json

Show its source and age:

relic security end-of-life status