{
  "slug": "grype-zarf-scan-target-scans-zarf-package-archives-c9caf2173ec1",
  "title": "grype zarf scan target scans Zarf package archives",
  "tools": [
    "grype"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-05T16:17:05.000Z",
  "announced_at": "2026-06-05T16:17:05.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When scanning a Zarf package archive, run Grype with the `zarf:` target and JSON output to produce a vulnerability report. The documented example uses a `.tar.zst` archive.",
    "examples": [
      "grype zarf:<path/to/package.tar.zst> -o json"
    ],
    "gotchas": [
      "Version: v0.114.0",
      "zarf:<path> (required): Zarf package archive target; the documented archive format is `.tar.zst`.",
      "-o, --output: Select report output format; `json` is shown for this scan.",
      "Prerequisite: Use Grype v0.114.0 or later for the Zarf scan target.",
      "The described archive format is .tar.zst."
    ]
  },
  "why_it_matters": "Scan a Zarf package archive and review vulnerabilities across its bundled artifacts.",
  "sources": [
    "https://github.com/anchore/grype/releases/tag/v0.114.0",
    "https://github.com/anchore/grype/pull/3366",
    "https://github.com/anchore/grype/issues/3329",
    "https://github.com/anchore/grype/blob/v0.114.0/cmd/grype/cli/commands/root.go"
  ],
  "rank": 0.97039,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-bd1a21bda6a4c06f-0:gate",
    "evidence_hash": "395e1737ac34dac2cd6f406776f461450ee883105f0ada48e4025d8fe8c23530"
  },
  "review": {
    "draft_hash": "b601ade5ed6eb94492fbe0bbb01a031ea1465c9cec3c510445a7ef5ca7735fdc",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.75 (>= 0.6 needed)."
  }
}