secureos provider

[divolgin]

Hello, we'd like to add support for secureos provider. This is the provider for images from securebuild.com.

This distro uses APK packages, and the provider is modeled after the Alpine provider.

Relevant grype PR: anchore/grype#3086
Relevant grype-db PR: anchore/grype-db#765

[squizzi]

The quality gate passes locally:

uv run yardstick validate --result-set pr_vs_latest_via_sbom_secureos
Loading label entries...done! 5 entries loaded
Validating with 'pr_vs_latest_via_sbom_secureos'
2026-01-21 11:10:16,207 [INFO] only considering matches from allowed namespaces: secureos:distro:secureos:rolling nvd:cpe
2026-01-21 11:10:16,207 [INFO] Testing image: 'registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000' with 'syft@latest, [email protected]/securebuildhq/grype@divolgin/secureos+import-db=build/vulnerability.db, [email protected]/securebuildhq/grype@divolgin/secureos+import-db=https://grype.anchore.io/databases/v6/vulnerability-db_v6.0.2_2025-07-10T01:31:11Z_1752120925.tar.zst'
   Results used for image registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000:
    ├── ea149fe1-074e-4d0a-b9cf-623062e1c7d1 : grype[custom-db]@0091f347 (custom-db)  against registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000
    └── 927e68b9-1c5c-49a4-8bed-f90e13e481d5 : grype[reference]@0091f347 (reference)  against registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000
--------------------------------------------------------------------------------

Quality gate passed!

Waiting for anchore/vulnerability-match-labels#170 to be merged so I can update this PR and have the tests run here.

[willmurphyscode]

We probably do not need 155 example JSON files for this provider. Does it make sense to come up with a representative subset?

[squizzi]

I've lowered this down to a subset of 17 json files which should provide adequate coverage

[squizzi]

@willmurphyscode I've updated each of the associated PRs based on our discussion this morning and updated the match labels as well, the quality gate is still passing locally with the label update:

uv tool run yardstick validate --result-set pr_vs_latest_via_sbom_secureos
Loading label entries...done! 5 entries loaded
Validating with 'pr_vs_latest_via_sbom_secureos'
2026-01-27 14:21:57,635 [INFO] only considering matches from allowed namespaces: secureos:distro:secureos:rolling nvd:cpe
2026-01-27 14:21:57,635 [INFO] Testing image: 'registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000' with 'syft@latest, [email protected]/securebuildhq/grype@divolgin/secureos+import-db=build/vulnerability.db, [email protected]/securebuildhq/grype@divolgin/secureos+import-db=https://grype.anchore.io/databases/v6/vulnerability-db_v6.0.2_2025-07-10T01:31:11Z_1752120925.tar.zst'
   Results used for image registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000:
    ├── c18aa66d-0ca5-4f5f-8d5f-017d48ae40b9 : grype[custom-db]@0091f347 (custom-db)  against registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000
    └── b560cd43-0e23-4ea0-9034-1d721a3d3f3f : grype[reference]@0091f347 (reference)  against registry.replicated.com/library/grype-test@sha256:3339bcd874d21fa3ca5bd20636e793c0c33bd71ace3a18a9a3b3d147b91dd000
--------------------------------------------------------------------------------

Quality gate passed!

Let me know if you need anything further from us around these.