Include vulnerability feed parsing code (maybe in another repo)

[rhdesmond]

What would you like to be added: The logic used for parsing the vulnerability feeds

Why is this needed:

Provides more transparency into the vulnerability data sources and creation of the vulnerability database (similar to open source scanners Trivy and osv-scanner).

[tgerla]

Hi @rhdesmond, this is something we're actively working on and we'll have something to share soon. It's a priority for us. Thanks for asking, and stay tuned. I'll leave this issue open and try to reply once we have something available.

[rhdesmond]

Awesome thanks! No rush

[wagoodman]

Wanted to drop an update here: we've open sourced the entire data pipeline for grype-db! There are two projects that relate to this:

• The python project where we pull and parse all of the upstream vulnerability data: https://github.com/anchore/vunnel
• The golang project that takes vunnel data and builds a grype database: https://github.com/anchore/grype-db

Here's the announcement post as well with further information https://anchore.com/blog/build-your-own-grype-database/

Shout out if you have more questions about this!