vimp

Normalize vulnerability data from multiple container image scanners into a unified format for cross-scanner comparison and trend analysis.

Why vimp?

Different vulnerability scanners often report different findings for the same container image. vimp helps you:

• Compare results across scanners to identify gaps in coverage
• Track trends over time with persistent storage
• Integrate with CI/CD using SARIF output for GitHub Code Scanning
• Reduce noise by correlating findings across sources

Quick Start

# Install vimp
brew tap mchmarny/vimp && brew install vimp

# Scan an image (requires grype, trivy, or snyk installed)
vimp scan --image alpine:latest --yes

# Query results
vimp query --image docker.io/library/alpine

# Run server (view reports, CVEs over time)
vimp server --open

Documentation

• User Guide - Step-by-step workflow tutorial with runnable examples
• CLI Reference - Complete command documentation

Supported Scanners

| Scanner | Format Detection | CVSS Support | |---------|------------------|--------------| | Grype | descriptor.name == "grype" | Full | | Trivy | SchemaVersion + Results | Full | | Snyk | vulnerabilities + applications | Full | | Clair | manifest_hash + vulnerabilities | None | | OSV-Scanner | results[*].packages[*].ecosystem | Partial | | Anchore Engine | imageDigest + vulnerabilities | Full |

Storage Backends

| Backend | URI Format | Query Support | |------------|--------------------------------|---------------| | SQLite | sqlite://path/to/db.db | Yes | | PostgreSQL | postgres://host:port/db | Yes | | BigQuery | bq://project.dataset.table | Import only | | File | file://path/to/output.json | No | | Console | console:// | No |

Default: sqlite://~/.vimp.db

Installation

Homebrew (macOS/Linux)

brew tap mchmarny/vimp
brew install vimp

Go

go install github.com/mchmarny/vimp@latest

Binary

Download from releases. All releases include:

• SHA256 checksums
• SPDX SBOMs
• Build provenance attestations

Linux Packages

Debian/Ubuntu:

VERSION=$(curl -s https://api.github.com/repos/mchmarny/vimp/releases/latest | jq -r .tag_name)
wget https://github.com/mchmarny/vimp/releases/download/${VERSION}/vimp-${VERSION#v}_linux-amd64.deb
sudo dpkg -i vimp-${VERSION#v}_linux-amd64.deb

RHEL/CentOS:

VERSION=$(curl -s https://api.github.com/repos/mchmarny/vimp/releases/latest | jq -r .tag_name)
sudo rpm -ivh https://github.com/mchmarny/vimp/releases/download/${VERSION}/vimp-${VERSION#v}_linux-amd64.rpm

Contributing

Contributions are welcome! See the Development Guide for setup instructions, architecture overview, and coding guidelines.

License

Apache 2.0

Disclaimer

This is a personal project and does not represent my employer. While I do my best to ensure everything works, I take no responsibility for issues caused by this code.