anchore
Added grype update command
Added grype update command #848. When running grype update latest version available is downloaded and grype binary is replaced.
I just learned to write golang so any code update or review is welcome. Not sure how we should test this feature.
Thanks @willyw0nka! This looks great. Kicked off the ci and will get around to getting you comments.
👋; I ran the actions and it looks like our Static Analysis tool picked up some suggested changes. Since you said you're new to the language these are great to look through to see some changes that can be made/updated.
Normally I can just add a commit that fixes these but didn't want to miss the chance to give you more information about your Golang journey.
Hi @spiffcs, after reviewing your comments and checking how the other commands were implemented now grype update uses the standard output format.
Output on stage download grype could be improved adopting grype db update download tracking progress bar output style, currently a spinner is shown while the newer grype version is downloaded.
This improvement was not included on this last commit due to the code duplication that it implies, mainly on grype/db/curator.go. Take a look at the current command output, if a more polished result is desired I could work on adapting the download tracking progress bar for grype update.
Hi @spiffcs :wave:! did you find some time to review the pull request update? I would love to recieve feedback on the update :smile:
Sorry, let me try and resolve this conflict so we can at least get the CI jobs running again. Apologies for the delay on this. I've been heads down over in syft and context switching at the moment is a little costly.
Did some cleanup and merged into main - will look again in the AM and ask the team about merging
I've played a bit more with this recently and don't think we want to increase the release surface area with this command.
This current implementation couples a lot of the update process with the current release mechanism. It duplicates a lot of the logic across the codebase. If any of those were to update then this command would break which gives me the impression that we need to use the linked issue to discuss/come up with a design that attempts to single source of truth more of this logic.
How can we get an update command that helps the user without duplicating or interfering with other methods of installation (package manager, brew, nix, etc)?