The summary by severity is confusing

[luhring]

What happened:

Back in August, someone opened an issue asking Grype to show a summary of vulnerability matches by severity: #877. This was a very logical idea, it's a great way to get an overall sense of a scan result.

The implementation ended up leveraging Grype's internal eventing system to "live update" the severity counts, but I think some tradeoffs were made that resulted in a user experience that raises more questions than answers.

It's now not uncommon to see output from Grype like this:

 ✔ Vulnerability DB        [no update available]
 ✔ Loaded image
 ✔ Parsed image
 ✔ Cataloged packages      [404 packages]
 ✔ Scanning image...       [2 vulnerabilities]
   ├── 0 critical, 1 high, 1 medium, 0 low, 0 negligible
   └── 0 fixed

No vulnerabilities found

Since this UX change, I've personally been asked by confused users, "what is this trying to tell me?" or "what is this hiding?" at least once a week.

What you expected to happen:

If Grype is deciding conclusively that a vulnerability does not match a package, it should never imply to the user that they might need to worry about that match.

This means two things:

1. The sum of severity counts should ALWYAS equal the count of vuln matches surfaces in the final output.
2. A vuln match should never be represented in the severity counts unless it's going to appear in the final output.

I mention the second point because it could be tempting to lean further into the eventing system, and have the severity counts decrement during Grype's filtering stage. I would caution against going this route — because that will raise even more questions about what Grype is doing (and possibly hiding). Users want this summary because they want to get a high level impression at a glance, not to dive into the inner workings of Grype's implementation.

My overall advice is to keep this simple, and that will go a long way for Grype's users.

[YevheniiPokhvalii]

I also agree to this post. @luhring You can check all the vulnerabilities with the -vv verbose flag. But I'm also confused what those vulnerabilities are if grype states that No vulnerabilities found.

[gh-greg]

#877

Indeed. Perhaps it would get us "back on track" , to more closely mimic something like what Prismacloud is doing.
I cited Prismacloud output, here:
#877 (comment)

Vulnerabilities found for image MY_IMAGE: total - 114, critical - 1, high - 6, medium - 57, low - 50
[PRISMACLOUD] Found 1 relevant files
[PRISMACLOUD] Found 114 vulnerabilities in 1 images

[luhring]

Thanks @kzantow!! 🤘