{
  "version": "2.1.0",
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "grype",
          "version": "0.0.0-dev",
          "informationUri": "https://github.com/anchore/grype",
          "rules": [
            {
              "id": "CVE-1999-0001-package-1",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-1999-0001 low vulnerability for package-1 package"
              },
              "fullDescription": {
                "text": "1999-01 description"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-1999-0001\nSeverity: low\nPackage: package-1\nVersion: 1.1.1\nFix Version: the-next-version\nType: rpm\nLocation: somefile-1.txt\nData Namespace: source-1\nLink: CVE-1999-0001",
                "markdown": "**Vulnerability CVE-1999-0001**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | package-1  | 1.1.1  | the-next-version  | rpm  | somefile-1.txt  | source-1  | CVE-1999-0001  |\n"
              },
              "properties": {
                "security-severity": "4.0"
              }
            },
            {
              "id": "CVE-1999-0002-package-2",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-1999-0002 critical vulnerability for package-2 package"
              },
              "fullDescription": {
                "text": "1999-02 description"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-1999-0002\nSeverity: critical\nPackage: package-2\nVersion: 2.2.2\nFix Version: \nType: deb\nLocation: somefile-2.txt\nData Namespace: source-2\nLink: CVE-1999-0002",
                "markdown": "**Vulnerability CVE-1999-0002**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| critical  | package-2  | 2.2.2  |   | deb  | somefile-2.txt  | source-2  | CVE-1999-0002  |\n"
              },
              "properties": {
                "security-severity": "1.0"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "CVE-1999-0001-package-1",
          "message": {
            "text": "A low vulnerability in rpm package: package-1, version 1.1.1 was found in image user-input at: somefile-1.txt"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "user-input/somefile-1.txt"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/foo/bar/somefile-1.txt",
                  "fullyQualifiedName": "user-input@:/somefile-1.txt"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "efe125c0a2b4bdafe476b69ba51a49734780c62b93803950319056acebe4323f:1"
          }
        },
        {
          "ruleId": "CVE-1999-0002-package-2",
          "message": {
            "text": "A critical vulnerability in deb package: package-2, version 2.2.2 was found in image user-input at: somefile-2.txt"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "user-input/somefile-2.txt"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/foo/bar/somefile-2.txt",
                  "fullyQualifiedName": "user-input@:/somefile-2.txt"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "bafe9890c7cda00bf4d1b1a57d1d20b08e27162e718235a3d38a9a8d2f449ed1:1"
          }
        }
      ]
    }
  ]
}