Diffused Library
The core Python library providing vulnerability scanning and diffing functionality for container images and SBOMs (Software Bill of Materials). This library enables programmatic access to vulnerability analysis capabilities.
Features
- 🔍 Vulnerability Scanning: Automated scanning of SBOMs using Trivy or scanning of container images using RHACS
- 🔀 Fixed & New Vulnerability Detection: Reports both vulnerabilities fixed and vulnerabilities newly introduced between two versions
- 📊 SBOM Diffing: Direct comparison of SPDX-JSON formatted SBOMs (Trivy only)
- 📄 Flexible Output: Programmatic access to vulnerability data
- 🐍 Python API: Clean, intuitive Python interface
Installation
Prerequisites
- Install the scanner:
- Trivy: Follow the official Trivy installation guide
- RHACS: Follow the official roxctl installation guide
- Python Environment: Ensure Python 3.9+ is installed
From Source
cd diffused
pip install -e .
From PyPI
pip install diffused-lib
Usage
Basic Library Usage
Comparing Container Images
from diffused.differ import VulnerabilityDiffer
# Create a differ instance for container images
vuln_differ = VulnerabilityDiffer(
previous_image="ubuntu:20.04",
next_image="ubuntu:22.04",
scan_type="image" # Automatically scans images
)
# Retrieve the vulnerabilities diff (list of fixed CVEs)
fixed_vulnerabilities = vuln_differ.vulnerabilities_diff
print(f"Fixed vulnerabilities: {fixed_vulnerabilities}")
# Get detailed information about each fixed vulnerability
detailed_info = vuln_differ.vulnerabilities_diff_all_info
# Retrieve the vulnerabilities introduced in the next image (list of new CVEs)
new_vulnerabilities = vuln_differ.new_vulnerabilities
print(f"New vulnerabilities: {new_vulnerabilities}")
# Get detailed information about each new vulnerability
new_detailed_info = vuln_differ.new_vulnerabilities_all_info
Comparing SBOMs
from diffused.differ import VulnerabilityDiffer
# Create a differ instance for SBOMs
vuln_differ = VulnerabilityDiffer(
previous_sbom="previous.sbom.json",
next_sbom="current.sbom.json",
scan_type="sbom" # Automatically scans SBOMs
)
# Retrieve the vulnerabilities diff
fixed_vulnerabilities = vuln_differ.vulnerabilities_diff
Using Different Scanners
from diffused.differ import VulnerabilityDiffer
# Use Trivy scanner (default)
trivy_differ = VulnerabilityDiffer(
previous_image="nginx:1.20",
next_image="nginx:1.21",
scanner="trivy",
scan_type="image"
)
# Use ACS scanner (requires ROX_ENDPOINT and either ROX_API_TOKEN or ROX_CONFIG_DIR)
acs_differ = VulnerabilityDiffer(
previous_image="nginx:1.20",
next_image="nginx:1.21",
scanner="acs",
scan_type="image"
)
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
diffused_lib-0.4.0.tar.gz
(18.8 kB
view details)
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file diffused_lib-0.4.0.tar.gz.
File metadata
- Download URL: diffused_lib-0.4.0.tar.gz
- Upload date:
- Size: 18.8 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
43e07ff4d9921a12b713b264eb69e2cc14d87ee6c916d25e647d1800ba5b3e2c
|
|
| MD5 |
534c3a05d10743408dca42db1cb3b54a
|
|
| BLAKE2b-256 |
df7bf28929c8633851c56f54ea9c1b906fd1106ddc2b5ec1e4be1103fad4426f
|
Provenance
The following attestation bundles were made for diffused_lib-0.4.0.tar.gz:
Publisher:
release.yml on konflux-ci/diffused
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
diffused_lib-0.4.0.tar.gz -
Subject digest:
43e07ff4d9921a12b713b264eb69e2cc14d87ee6c916d25e647d1800ba5b3e2c - Sigstore transparency entry: 2759300164
- Sigstore integration time:
-
Permalink:
konflux-ci/diffused@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Branch / Tag:
refs/tags/v0.4.0 - Owner: https://github.com/konflux-ci
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Trigger Event:
push
-
Statement type:
File details
Details for the file diffused_lib-0.4.0-py3-none-any.whl.
File metadata
- Download URL: diffused_lib-0.4.0-py3-none-any.whl
- Upload date:
- Size: 11.8 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
88dc480193239230cd183ff22f04767200e997adf2e66ce43b865bcf8f236b57
|
|
| MD5 |
24240d23ca7fbade0128518f32041fcc
|
|
| BLAKE2b-256 |
c738e0df94016377d6162326bcd44aaf62820d36a7705b3564d51249c25b918d
|
Provenance
The following attestation bundles were made for diffused_lib-0.4.0-py3-none-any.whl:
Publisher:
release.yml on konflux-ci/diffused
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
diffused_lib-0.4.0-py3-none-any.whl -
Subject digest:
88dc480193239230cd183ff22f04767200e997adf2e66ce43b865bcf8f236b57 - Sigstore transparency entry: 2759300206
- Sigstore integration time:
-
Permalink:
konflux-ci/diffused@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Branch / Tag:
refs/tags/v0.4.0 - Owner: https://github.com/konflux-ci
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@53266d94a1e51ddfb59ae52e6ee7062f56f6bb42 -
Trigger Event:
push
-
Statement type:
