Diffused CLI
Command-line interface for the Diffused vulnerability scanning and diffing library. This tool provides an easy-to-use interface for comparing container images and SBOMs (Software Bill of Materials) to track security improvements and regressions.
Features
- 🔍 Container Image Comparison: Compare vulnerabilities between different container image versions
- 📊 SBOM Diffing: Direct comparison of SPDX-JSON formatted SBOMs (Trivy only)
- 📄 Multiple Output Formats: Support for both rich text and JSON output
- 🎨 Rich Terminal Output: Beautiful, colored output for better readability
Installation
Prerequisites
- Install the scanner:
- Trivy: Follow the official Trivy installation guide
- RHACS: Follow the official roxctl installation guide
- Python Environment: Ensure Python 3.9+ is installed
From Source
# Install the library
pip install -e ./diffused
# Install the CLI
pip install -e ./diffusedcli
From PyPI
pip install diffusedcli
Usage
Compare Container Images
# Basic vulnerability diff between two container images (fixed vulnerabilities)
diffused image-diff -p ubuntu:20.04 -n ubuntu:22.04
# Report vulnerabilities newly introduced in the next image
diffused image-diff -p ubuntu:20.04 -n ubuntu:22.04 --show new
# Report both fixed and new vulnerabilities
diffused image-diff -p ubuntu:20.04 -n ubuntu:22.04 --show all
# Use ACS scanner
diffused --scanner acs image-diff -p nginx:1.20 -n nginx:1.21
# Save output to JSON file
diffused image-diff -p app:v1.0 -n app:v2.0 --output json --file report.json
Compare SBOMs
# Compare two SBOM files (fixed vulnerabilities)
diffused sbom-diff -p previous.json -n current.json
# Report vulnerabilities newly introduced in the next SBOM
diffused sbom-diff -p previous.json -n current.json --show new
# Report both fixed and new vulnerabilities with detailed information
diffused sbom-diff -p previous.json -n current.json --show all --all-info
# Get detailed vulnerability information
diffused sbom-diff -p old-sbom.json -n new-sbom.json --all-info
# Export to file with rich formatting
diffused sbom-diff -p v1-sbom.json -n v2-sbom.json --file vulnerability-report.txt
CLI Commands and Options
For more information on commands and options, use the --help option.
Commands
| Command | Description |
|---|---|
image-diff |
Show the vulnerability diff between two container images |
sbom-diff |
Show the vulnerability diff between two SBOMs |
Global Options
| Option | Short | Description | Default |
|---|---|---|---|
--scanner |
-s |
Scanner to use (acs, trivy) |
trivy |
--output |
-o |
Output format (rich, json) |
rich |
--file |
-f |
Output file (use - for stdout) |
- |
--help |
-h |
Show help message | - |
image-diff Options
| Option | Short | Description | Required |
|---|---|---|---|
--previous-image |
-p |
Previous container image URL | Yes |
--next-image |
-n |
Next container image URL | Yes |
--show |
Which vulnerabilities to report (fixed, new, all) |
No (default fixed) |
|
--output |
-o |
Output format (rich, json) |
rich |
--file |
-f |
Output file (use - for stdout) |
- |
sbom-diff Options
| Option | Short | Description | Required |
|---|---|---|---|
--previous-sbom |
-p |
Previous SBOM file path | Yes |
--next-sbom |
-n |
Next SBOM file path | Yes |
--all-info |
-a |
Show detailed vulnerability information (SBOM only) | False |
--show |
Which vulnerabilities to report (fixed, new, all) |
No (default fixed) |
|
--output |
-o |
Output format (rich, json) |
rich |
--file |
-f |
Output file (use - for stdout) |
- |
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
diffused_cli-0.4.0.tar.gz
(9.8 kB
view details)
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file diffused_cli-0.4.0.tar.gz.
File metadata
- Download URL: diffused_cli-0.4.0.tar.gz
- Upload date:
- Size: 9.8 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
9d135977e085f01f879cc6a2563b01ce1e829cb451460407b34b113c46e78535
|
|
| MD5 |
c4f002c48e8417df16462b6ba1551ac7
|
|
| BLAKE2b-256 |
e9377160b3af1ef2c5005691c4c9f84d97de39cd10081358e8dc57a772e75320
|
Provenance
The following attestation bundles were made for diffused_cli-0.4.0.tar.gz:
Publisher:
release.yml on konflux-ci/diffused
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
diffused_cli-0.4.0.tar.gz -
Subject digest:
9d135977e085f01f879cc6a2563b01ce1e829cb451460407b34b113c46e78535 - Sigstore transparency entry: 2759300915
- Sigstore integration time:
-
Permalink:
konflux-ci/diffused@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Branch / Tag:
refs/tags/v0.4.0 - Owner: https://github.com/konflux-ci
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Trigger Event:
push
-
Statement type:
File details
Details for the file diffused_cli-0.4.0-py3-none-any.whl.
File metadata
- Download URL: diffused_cli-0.4.0-py3-none-any.whl
- Upload date:
- Size: 5.6 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
ad0950a3b94349040ce28dc6f1f25a18ad5443efc57cb524e94ca65fe1e334f1
|
|
| MD5 |
0209bd87f62fdf82f8a34d9ed1a26507
|
|
| BLAKE2b-256 |
743f66ecd30254630f0b368a730c1907df841875a4a30405ef652e9878af5c59
|
Provenance
The following attestation bundles were made for diffused_cli-0.4.0-py3-none-any.whl:
Publisher:
release.yml on konflux-ci/diffused
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
diffused_cli-0.4.0-py3-none-any.whl -
Subject digest:
ad0950a3b94349040ce28dc6f1f25a18ad5443efc57cb524e94ca65fe1e334f1 - Sigstore transparency entry: 2759300953
- Sigstore integration time:
-
Permalink:
konflux-ci/diffused@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Branch / Tag:
refs/tags/v0.4.0 - Owner: https://github.com/konflux-ci
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Trigger Event:
push
-
Statement type:
