Extend vulnerability matchers about grype

[dandandy]

Hi, is this ticket ready to be worked on? If so, I'm interested in taking a look

[wagoodman]

@dandandy there is work ready to be picked up, but not in grype quite yet.

Specifically, grype uses syft in order to discover packages... the work that needs to be done first is to add new catalogers to syft to to be able to discover packages from these new sources for pacman and pipenv. I've created a couple of new issues to encapsulate that work: anchore/syft#241 and anchore/syft#242 .

As for adding a new cataloger into syft, let's take pipenv as an example. Pipenv is a cataloger for "index" files which we actively look for when scanning directories and not images. To add a new index cataloger you'd need to:

1. create a new parser function that can parse a pipfile.lock and return a set of packages (for an example, here is the parser function for requirements.txt files)
2. wire up that parser to the existing index cataloger with the corresponding **/Pipfile.lock glob: https://github.com/anchore/syft/blob/main/syft/cataloger/python/index_cataloger.go#L12-L16
3. add unit tests to cover the parser function

Happy to answer any questions on this work (reach out on those tickets or on the #toolbox-dev slack channel for more realtime conversation)!