CVE comparison

GRYPE_BIN=/path/to/grype-0.109.1 \
  tools/cve-compare/run.sh /tmp/minimal-cve-comparison

The run is resumable: valid raw JSON reports are reused. Set CVE_COMPARE_CONCURRENCY conservatively because registry scans temporarily download image layers.

Methodology:

• linux/amd64 and production :latest only.
• Tags are resolved to immutable digests before scanning.
• Raw Grype matches are compared; vendor-specific VEX is not applied.
• Unavailable/private/non-equivalent competitor images are reported as N/A, never as zero vulnerabilities.
• The mapping intentionally uses only publicly pullable Chainguard images.
• latest may represent different application versions. Check the saved image reference and digest before drawing product-level conclusions.