{"id":19368459,"url":"https://github.com/anchore/yardstick","last_synced_at":"2026-02-10T17:11:00.276Z","repository":{"id":61693757,"uuid":"540144763","full_name":"anchore/yardstick","owner":"anchore","description":"Compare vulnerability scanners results (to make them better!)","archived":false,"fork":false,"pushed_at":"2026-02-09T15:07:18.000Z","size":1487,"stargazers_count":27,"open_issues_count":7,"forks_count":7,"subscribers_count":12,"default_branch":"main","last_synced_at":"2026-02-09T19:44:15.434Z","etag":null,"topics":["grype","hacktoberfest","vulnerability","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anchore.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-09-22T19:46:04.000Z","updated_at":"2026-02-09T15:08:07.000Z","dependencies_parsed_at":"2024-05-20T19:52:57.076Z","dependency_job_id":"9d43f63c-1a72-47df-a2dd-a420f12812d3","html_url":"https://github.com/anchore/yardstick","commit_stats":null,"previous_names":[],"tags_count":31,"template":false,"template_full_name":null,"purl":"pkg:github/anchore/yardstick","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fyardstick","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fyardstick/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fyardstick/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fyardstick/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anchore","download_url":"https://codeload.github.com/anchore/yardstick/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fyardstick/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29309158,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-10T16:09:25.305Z","status":"ssl_error","status_checked_at":"2026-02-10T16:08:52.170Z","response_time":65,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["grype","hacktoberfest","vulnerability","vulnerability-scanners"],"created_at":"2024-11-10T08:06:28.532Z","updated_at":"2026-02-10T17:11:00.260Z","avatar_url":"https://github.com/anchore.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# yardstick\n\nA tool that can parse and compare the results of vulnerability scanner tools.\n\nManage and explore scan results:\n```\n# capture a new scan result for a specific tool and image\nyardstick result capture --image ubuntu:20.04 -t grype@v0.11.0\n\n# list all scan results that have been captured\nyardstick result list\n\n# explore the scan results interactively\nyardstick result explore \u003cUUID\u003e\n```\n\nManage true positive / false positive labels for images:\n```\n# explore labels applied to specific scan-result matches for an image and tool pair\nyardstick label explore \u003cUUID\u003e\n\n# list all managed labels\nyardstick label list\n```\n\nSupported scanners:\n- `grype`\n- `syft`\n\n### F.A.Q.\n\n*\"Why is syft on this list? It's not a vulnerability scanner!\"*\n\nRight you are, however, capturing SBOM results that can be fed into grype or for\nreference during analysis is quite useful!\n\n\n*\"Yardstick doesn't support vulnerability scanner X...\"*\n\nPR's are welcome! The goal of this tool is to provide the analysis capabilities\nto understand how we can make these scanners better.\n\n\n\n## Result Sets\n\nResult sets can be useful to operate on and track results from scans taken at the same time. For instance:\n```yaml\n# .yardstick.yaml\nresult-sets:\n  example:\n    matrix:\n      images:\n        - ubuntu:20.04\n      tools:\n        - name: grype\n          version: v0.32.0\n        - name: grype\n          version: v0.48.0\n```\n\n```bash\n# capture results for all tools\n$ yardstick result capture -r example\n\n# see the specific result details\n$ yardstick result list -r example\n\n# perform a label comparison using all tooling\n$ yardstick label compare -r example\n```\n\n\n## Configuration\n\nSample application config:\n```yaml\n# .yardstick.yaml\n\nx-ref:\n  images: \u0026images\n    - docker.io/cloudbees/cloudbees-core-mm:2.346.4.1@sha256:b8ec61aad2f5f9be2dc9c68923eab1de0e8b026176093ad2e0742fca310bf3bf\n\nresult-sets:\n  pr-vs-latest:\n    description: \"latest released grype vs grype from the current build\"\n    matrix:\n      images: *images\n      tools:\n        - name: syft                      # go ahead and capture an SBOM each time to help analysis later\n          version: v0.54.0\n          produces: SBOM\n\n        - name: grype                     # from the latest published github release\n          version: latest\n          takes: SBOM\n\n        - name: grype:pr                  # from a local PR checkout install (feed via an environment variable)\n          version: env:CURRENT_GRYPE_COMMIT\n          takes: SBOM\n```\n\n## CLI Commands\n\n```\n  config  show the application config\n\n  label   manage match labels\n\n    add                   add a match label indication for an image\n    apply                 see which labels apply to the given image and...\n    compare               compare a scan result against labeled data\n    compare-by-ecosystem  show TPs/FPs/Precision from label comparison...\n    explore               interact with an label results for a single image...\n    images                show all images derived from label data\n    list                  show all labels\n    remove                remove a match label indication for an image\n    set-image-parent      set the parent image for a given image\n    show-image-lineage    show all parents and children for the given image\n\n  result  manage image scan results\n\n    capture  capture all tool output for the given image\n    clear    remove all results and result sets\n    compare  show a comparison between tool output\n    explore  interact with an image scan result\n    images   list images in results\n    import   import results for a tool that were run externally\n    list     list stored results\n    sets     list configured result sets\n    show     show a the results for a single scan + tool\n    tools    list tools in results\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fyardstick","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanchore%2Fyardstick","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fyardstick/lists"}