/usr/bin/xeol

A scanner for end-of-life (EOL) software in container images, filesystems, and SBOMs.

Supports the following image sources:
    xeol yourrepo/yourimage:tag             defaults to using images from a Docker daemon
    xeol path/to/yourproject                a Docker tar, OCI tar, OCI directory, SIF container, or generic filesystem directory

You can also explicitly specify the scheme to use:
    xeol podman:yourrepo/yourimage:tag          explicitly use the Podman daemon
    xeol docker:yourrepo/yourimage:tag          explicitly use the Docker daemon
    xeol docker-archive:path/to/yourimage.tar   use a tarball from disk for archives created from "docker save"
    xeol oci-archive:path/to/yourimage.tar      use a tarball from disk for OCI archives (from Podman or otherwise)
    xeol oci-dir:path/to/yourimage              read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
    xeol singularity:path/to/yourimage.sif      read directly from a Singularity Image Format (SIF) container on disk
    xeol dir:path/to/yourproject                read directly from a path on disk (any directory)
    xeol sbom:path/to/syft.json                 read Syft JSON from path on disk
    xeol registry:yourrepo/yourimage:tag        pull image directly from a registry (no container runtime required)
    xeol purl:path/to/purl/file                 read a newline separated file of purls from a path on disk

You can also pipe in Syft JSON directly:
	syft yourimage:tag -o json | xeol

Usage:
  xeol [IMAGE] [flags]
  xeol [command]

Available Commands:
  completion  Generate a shell completion for xeol (listing local docker images)
  db          EOL database operations
  help        Help about any command
  version     show version information

Flags:
      --api-key string        set the API key for xeol.io. When this is set, scans will be uploaded to xeol.io.
  -c, --config string         xeol configuration file
      --distro string         distro to match against in the format: <distro>:<version>
  -f, --fail-on-eol-found     set the return code to 1 if an EOL package is found
      --file string           file to write the default report output to (default is STDOUT)
  -h, --help                  help for xeol
  -l, --lookahead string      an optional lookahead specifier when matching EOL dates (e.g. 'none', '1d', '1w', '1m', '1y'). Packages are matched when their EOL date < today+lookahead (default "1y")
      --name string           set the name of the target being analyzed
  -o, --output stringArray    report output formatter, formats=[json table]
      --platform string       an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')
      --project-name string   manually set the name of the project being analyzed for xeol.io. If you are running xeol inside a git repository, this will be automatically detected.
  -q, --quiet                 suppress all logging output
  -s, --scope string          selection of layers to analyze, options=[squashed all-layers] (default "squashed")
      --show-vuln-count       show the number of vulnerabilities found for each package (default is false)
  -v, --verbose count         increase verbosity (-v = info, -vv = debug)
      --version               version for xeol

Use "xeol [command] --help" for more information about a command.