{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0-rtm.5.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Grype",
          "version": "0.0.0-dev",
          "informationUri": "https://github.com/anchore/grype",
          "rules": [
            {
              "id": "CVE-1999-0001-package-1",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-1999-0001 low vulnerability for package-1 package"
              },
              "fullDescription": {
                "text": "1999-01 description"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-1999-0001\nSeverity: low\nPackage: package-1\nVersion: 1.0.1\nFix Version: \nType: deb\nLocation: etc/pkg-1\nData Namespace: source-1\nLink: CVE-1999-0001",
                "markdown": "**Vulnerability CVE-1999-0001**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | package-1  | 1.0.1  |   | deb  | etc/pkg-1  | source-1  | CVE-1999-0001  |\n"
              },
              "properties": {
                "security-severity": "4.0"
              }
            },
            {
              "id": "CVE-1999-0002-package-2",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-1999-0002 critical vulnerability for package-2 package"
              },
              "fullDescription": {
                "text": "1999-02 description"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-1999-0002\nSeverity: critical\nPackage: package-2\nVersion: 2.0.1\nFix Version: \nType: deb\nLocation: pkg-2\nData Namespace: source-2\nLink: CVE-1999-0002",
                "markdown": "**Vulnerability CVE-1999-0002**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| critical  | package-2  | 2.0.1  |   | deb  | pkg-2  | source-2  | CVE-1999-0002  |\n"
              },
              "properties": {
                "security-severity": "1.0"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "CVE-1999-0001-package-1",
          "message": {
            "text": "The path etc/pkg-1 reports package-1 at version 1.0.1  which is a vulnerable (deb) package installed in the container"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "image/etc/pkg-1"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "etc/pkg-1",
                  "fullyQualifiedName": "user-input@sha256:asdf:/etc/pkg-1"
                }
              ]
            }
          ]
        },
        {
          "ruleId": "CVE-1999-0002-package-2",
          "message": {
            "text": "The path pkg-2 reports package-2 at version 2.0.1  which is a vulnerable (deb) package installed in the container"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "image/pkg-2"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "pkg-2",
                  "fullyQualifiedName": "user-input@sha256:asdf:/pkg-2"
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}