Replace grype db diff with grype db search --since DATE

[wagoodman]

As currently written the DB diff command will be cumbersome to keep as a feature while working on v6. We could leave DB diff in tact for v1-5 schemas, but this would be confusing for users attempting to use this diff feature for the latest (v6) DBs.

V6 currently is going to have a blobs table where digests for content could be recomputed and used as a foundation for a diff, however that is out of scope for v6 unless there is a convincing argument / need to keep this feature and add to the v6 scope further.

[TimBrown1611]

hi! @wagoodman diff is important since we want to track changes of the DB.
how can it be done on v6 schema? will v6 contain update date for each record?
thanks!

[wagoodman]

As eluded to in #2128 (comment) there is a way to compute the records that differ.

Is this an important use case to you? If so, can you tell us more about why so?

We dropped figuring this out in v6 to cut scope, but if we have enough users that really depend on this then that would be good reason to keep it in scope (in which case I'd close this issue and make a new one on how to implement the diff command).

[TimBrown1611]

I use this command to handle states of last-modified CVEs.
I have to do it separately since the DB is stateless, and some sources don't provide modified date or create date.

[willmurphyscode]

@TimBrown1611 when you say some sources don't provide modified or created date, do you mean in the upstream data? Like, are there specific data sources that grype db consumes that are missing this data? If so, which ones?

If grype had a date added and date updated date for most issues in each database, would you still need grype db diff?

[willmurphyscode]

From discussion on our livestream on 10 October 2024, we had the idea:

Can we add grype db search --since DATE to print information about CVEs that were added or changed since DATE. Schema v6 would support that, and it seems like this is a simpler, more flexible way of comparing two databases. @TimBrown1611 would that meet your needs?

Things to consider:

1. What if data is deleted between db versions?
2. How to handle differences between what dates are available from different providers?

[TimBrown1611]

Hi,

1. If a CVE was deleted its ok since it will not appear in the results.
2. Namespace field will be removed in v6?