Diffused CLI

Command-line interface for the Diffused vulnerability scanning and diffing library. This tool provides an easy-to-use interface for comparing container images and SBOMs (Software Bill of Materials) to track security improvements and regressions.

Features

🔍 Container Image Comparison: Compare vulnerabilities between different container image versions
📊 SBOM Diffing: Direct comparison of SPDX-JSON formatted SBOMs (Trivy only)
📄 Multiple Output Formats: Support for both rich text and JSON output
🎨 Rich Terminal Output: Beautiful, colored output for better readability

Installation

Prerequisites

Install the scanner:
1. Trivy: Follow the official Trivy installation guide
2. RHACS: Follow the official roxctl installation guide
Python Environment: Ensure Python 3.9+ is installed

From Source

# Install the library
pip install -e ./diffused

# Install the CLI
pip install -e ./diffusedcli

From PyPI

pip install diffusedcli

Usage

Compare Container Images

# Basic vulnerability diff between two container images (fixed vulnerabilities)
diffused image-diff -p ubuntu:20.04 -n ubuntu:22.04

# Report vulnerabilities newly introduced in the next image
diffused image-diff -p ubuntu:20.04 -n ubuntu:22.04 --show new

# Report both fixed and new vulnerabilities
diffused image-diff -p ubuntu:20.04 -n ubuntu:22.04 --show all

# Use ACS scanner
diffused --scanner acs image-diff -p nginx:1.20 -n nginx:1.21

# Save output to JSON file
diffused image-diff -p app:v1.0 -n app:v2.0 --output json --file report.json

Compare SBOMs

# Compare two SBOM files (fixed vulnerabilities)
diffused sbom-diff -p previous.json -n current.json

# Report vulnerabilities newly introduced in the next SBOM
diffused sbom-diff -p previous.json -n current.json --show new

# Report both fixed and new vulnerabilities with detailed information
diffused sbom-diff -p previous.json -n current.json --show all --all-info

# Get detailed vulnerability information
diffused sbom-diff -p old-sbom.json -n new-sbom.json --all-info

# Export to file with rich formatting
diffused sbom-diff -p v1-sbom.json -n v2-sbom.json --file vulnerability-report.txt

CLI Commands and Options

For more information on commands and options, use the --help option.

Commands

Command	Description
`image-diff`	Show the vulnerability diff between two container images
`sbom-diff`	Show the vulnerability diff between two SBOMs

Global Options

Option	Short	Description	Default
`--scanner`	`-s`	Scanner to use (`acs`, `trivy`)	`trivy`
`--output`	`-o`	Output format (`rich`, `json`)	`rich`
`--file`	`-f`	Output file (use `-` for stdout)	`-`
`--help`	`-h`	Show help message	-

image-diff Options

Option	Short	Description	Required
`--previous-image`	`-p`	Previous container image URL	Yes
`--next-image`	`-n`	Next container image URL	Yes
`--show`		Which vulnerabilities to report (`fixed`, `new`, `all`)	No (default `fixed`)
`--output`	`-o`	Output format (`rich`, `json`)	`rich`
`--file`	`-f`	Output file (use `-` for stdout)	`-`

sbom-diff Options

Option	Short	Description	Required
`--previous-sbom`	`-p`	Previous SBOM file path	Yes
`--next-sbom`	`-n`	Next SBOM file path	Yes
`--all-info`	`-a`	Show detailed vulnerability information (SBOM only)	`False`
`--show`		Which vulnerabilities to report (`fixed`, `new`, `all`)	No (default `fixed`)
`--output`	`-o`	Output format (`rich`, `json`)	`rich`
`--file`	`-f`	Output file (use `-` for stdout)	`-`

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

diffused_cli-0.5.0.tar.gz (9.8 kB view details)

Uploaded Sep 8, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

diffused_cli-0.5.0-py3-none-any.whl (5.5 kB view details)

Uploaded Sep 8, 2026 Python 3

File details

Details for the file diffused_cli-0.5.0.tar.gz.

File metadata

Download URL: diffused_cli-0.5.0.tar.gz
Upload date: Sep 8, 2026
Size: 9.8 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for diffused_cli-0.5.0.tar.gz
Algorithm	Hash digest
SHA256	`62f270c15dfef7a8e9a71f04774660990e7ad18ea6a957247e94c2ff29601a68`
MD5	`c56a8d5a3552b356af6d6261b08381e1`
BLAKE2b-256	`b6474534a7e566ad8a26d01d62e03704659254ae18389b5c736654c3ee51daf3`

See more details on using hashes here.

Provenance

The following attestation bundles were made for diffused_cli-0.5.0.tar.gz:

Publisher: release.yml on konflux-ci/diffused

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: diffused_cli-0.5.0.tar.gz
- Subject digest: 62f270c15dfef7a8e9a71f04774660990e7ad18ea6a957247e94c2ff29601a68
- Sigstore transparency entry: 2759328211
- Sigstore integration time: Sep 8, 2026
Source repository:
- Permalink: konflux-ci/diffused@69d87fa3ac69d1a1bab077cf6c38a5ad6f363fc4
- Branch / Tag: refs/tags/v0.5.0
- Owner: https://github.com/konflux-ci
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: release.yml@69d87fa3ac69d1a1bab077cf6c38a5ad6f363fc4
- Trigger Event: push

File details

Details for the file diffused_cli-0.5.0-py3-none-any.whl.

File metadata

Download URL: diffused_cli-0.5.0-py3-none-any.whl
Upload date: Sep 8, 2026
Size: 5.5 kB
Tags: Python 3
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for diffused_cli-0.5.0-py3-none-any.whl
Algorithm	Hash digest
SHA256	`42ba747a70edbb057c17c31cc5b779d42f1dfe405dc60b15aab3df2a4434688a`
MD5	`e5155e08f57421ecd40bd2b63ac4fbc5`
BLAKE2b-256	`9376a2e6303899e1f9c2f97ee99538702ef96cbfef267bd20055d18ce3580a90`

See more details on using hashes here.

Provenance

The following attestation bundles were made for diffused_cli-0.5.0-py3-none-any.whl:

Publisher: release.yml on konflux-ci/diffused

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: diffused_cli-0.5.0-py3-none-any.whl
- Subject digest: 42ba747a70edbb057c17c31cc5b779d42f1dfe405dc60b15aab3df2a4434688a
- Sigstore transparency entry: 2759328391
- Sigstore integration time: Sep 8, 2026
Source repository:
- Permalink: konflux-ci/diffused@69d87fa3ac69d1a1bab077cf6c38a5ad6f363fc4
- Branch / Tag: refs/tags/v0.5.0
- Owner: https://github.com/konflux-ci
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: release.yml@69d87fa3ac69d1a1bab077cf6c38a5ad6f363fc4
- Trigger Event: push

Release history Release notifications | RSS feed

This release

0.5.0 This release

Sep 8, 2026 2 files

Sep 8, 2026 2 files

Jan 19, 2026 2 files

Oct 22, 2025 2 files

Sep 30, 2025 2 files

diffused-cli 0.5.0

Diffused CLI

Features

Installation

Prerequisites

From Source

From PyPI

Usage

Compare Container Images

Compare SBOMs

CLI Commands and Options

Commands

Global Options

image-diff Options

sbom-diff Options

Project links

Key dates

1 maintainer

Credits

GitHub Statistics

License expression

Requires

Provides Extra

Tags

Classifiers

Download files

Source Distribution

Built Distribution

File details

File metadata

File hashes

Provenance

File details

File metadata

File hashes

Provenance

Release history Release notifications | RSS feed