Best way to export CVEs Infos from an existing Image in (selg-hosted) quay?

6 views
Skip to first unread message

Flomickl

unread,
Mar 11, 2025, 1:51:53 AMMar 11
to quay-sig
Hi, everything is up and running (self hosted) and after I pushed an image, clair is scanning and I can see the results with CVE score in the GUI as expected

But If I try to get the CVE Information from the Image like


```
curl -u "<ROBOT-USER>:<TOKEN>"   -H "Accept: application/json"   "https://quay.example.lan/api/v1/repository/my-repo/my-image/manifest/sha256:2ddcb7e8c0214ff8d27e289d922229b37cc7e47c37d88bd9af03ae58d928207c/security?vulnerabilities=true" | jq > output.json
```

I only get something like following, but the CVE Score and information are missing. So I wonder what is the best way to export the scanning result in quay? Is there a way other than the GUI look itself. I want a proper JSON so I can share this information with me, myself and my security team ;)


```
...
 {
          "Name": "org.XXXXX",
          "VersionFormat": "",
          "NamespaceName": "",
          "AddedBy": "sha256:b195b1a5fcb27354a9ee6dbc0fe75ed84424226a16ff3245ef424aa5dde9603b",
          "Version": "3.78.0-14",
          "BaseScores": [],
          "CVEIds": [],
          "Vulnerabilities": []
        },
        {
          "Name": "com.google.android:annotations",
          "VersionFormat": "",
          "NamespaceName": "",
          "AddedBy": "sha256:b195b1a5fcb27354a9ee6dbc0fe75ed84424226a16ff3245ef424aa5dde9603b",
          "Version": "4.1.1.4",
          "BaseScores": [],
          "CVEIds": [],
          "Vulnerabilities": []
        }, 
``
Reply all
Reply to author
Forward
0 new messages