v1.8.0

Highlights

• Add new attestation-add command to GHA
  This can be used to add Vex documents to images for instance. See the documentation on how to suppress image vulnerabilities with VEX

  uses: docker/scout-action@v1
  with:
    command: attestation-add
    image: IMAGE
    file: in-toto.vex.json
    predicate-type: https://openvex.dev/ns/v0.2.0

Bug Fixes / Improvements

• Improve format of EPSS score and percentile
  • Before:

    EPSS Score      : 0.000440
    EPSS Percentile : 0.092510
    

  • After:

    EPSS Score      : 0.04%
    EPSS Percentile : 9th percentile
    

• Fix cves command when used to analyse a local file system with a markdown output

---

Contributors

v1.7.0

Highlights

• Allow to specify format (json, list, spdx) and output file on sbom command

  uses: docker/scout-action@v1
  with:
      command: sbom
      image: alpine
      format: list
      output: alpine_package_list.txt

Bug Fixes / Improvements

• Fix adding attestation (like vex statements) to a private image
• fix image processing for scratch "images"
• Add classifier for Joomla

---

Contributors

v1.6.4

Bug Fix

Fix epoch handling for rpm-based images

---

Contributor(s)

v1.6.3

Bug Fixes / Improvements

• improve package detection to ignore referenced but not installed packages

---

Contributors

v1.6.2

Bug Fixes / Improvements

• fix an issue when rendering markdown output using sbom:// prefix

---

Contributors

v1.6.1

Highlights

• Add support for passing in SBOM files in SDPX or in-toto SDPX format

  uses: docker/scout-action@v1
  with:
      command: cves
      image: sbom://alpine.spdx.json

• Add support for SBOM files in syft-json format

  uses: docker/scout-action@v1
  with:
      command: cves
      image: sbom://alpine.syft.json

Bug Fixes / Improvements

• Fix panic when indexing single image oci-dir input
• Improve local attestation support with the containerd image store

---

Contributors

v1.5.2

General bug fixes and performance improvements

v1.5.0

Highlights

• Cache SBOM and attestations using the image index digest if exists
• Add file hashes/digest when generating SBOMs
• Upgrade syft to 0.105.0
• Support local attestations from a containerd image store or OCI export

Bug fixes / Improvements

• fix reading SBOM for gcr.io/distroless images
• read distribution in SBOM from attestations

v1.4.1

These notes include changes part of v1.4.0

Highlights

• Update dependencies to address Leaky Vessels series of CVEs (CVE-2024-21626, CVE-2024-24557)
• Add initial VEX document to document false positive CVE-2020-8911 and CVE-2020-8912
• Support cosign SBOM attestations
• Support for VEX in-toto attestations

Bug fixes / Improvements

• Fix platform detection when an image index contains linux/arm64/v8 but the local platform is only linux/arm64
• Fix display of the base image in case the base image is not indexed by docker scout but defined in the provenance attestation (for private or non Docker Trusted Content base images)
  Affects quickview and recommendations commands
• Fix panic when an SBOM contains no packages
  Especially when using docker scout to analyse local file system, for instance using docker scout cves fs://.
• Bump Syft to 102 to fix golang Purl with subpath
• Add support for subpaths in PURLs
  For instance an image containing both packages github.com/gofiber/template and github.com/gofiber/template/django/v3, previously the two packages were visible under the same github.com/gofiber/template name. Now both of them are correctly identified

v1.3.0

• Update syft to v0.100.0
• Support in-toto envelope layer in attestations
• Improve display of policy results in case of a boolean policy