craevidence/cli repository overview

# List the available commands
docker run --rm craevidence/cli:latest --help

# Scan a container image for known vulnerabilities
docker run --rm craevidence/cli:latest check --image nginx:1.27

# Or check an SBOM file from the current directory
docker run --rm -v "$PWD:/work" -w /work craevidence/cli:latest check sbom.cdx.json

check never sends data to CRA Evidence. By default it uses the network for
vulnerability data (Grype when available, OSV.dev as a fallback, plus CISA KEV
and FIRST EPSS for enrichment). It is a local snapshot, not an audit, and an
exit code of 0 does not by itself prove compliance.

Assess CRA applicability (offline)

docker run --rm -v "$PWD:/work" -w /work craevidence/cli:latest \
  assessment new --template consumer-iot --product "My Device" --non-interactive

Run assessment templates to list the available product types.

Upload evidence (requires an API key)

docker run --rm -e CRA_EVIDENCE_API_KEY -v "$PWD:/work" -w /work \
  craevidence/cli:latest \
  upload-sbom --product my-product --version 1.0.0 --file sbom.cdx.json

Set CRA_EVIDENCE_API_KEY in your environment. The default API endpoint is https://api.craevidence.com (override with CRA_EVIDENCE_URL).