Expanding Vulnerability Scanning

[bpmooch]

Description

From your documentation, trivy currently supports pulling vulnerability information for repo official OS packages, languages specific packages such as npm packages for javascript, and k8s component vulnerabilities.

Of course, there are many different things trivy could scan for that are outside the scope of these three data sources. Do you see Trivy expanding support for vulnerability scanning targets, or expanding the scope of vulnerability scanning tasks? For example, it may be of interest to some users to find arbitrary binaries that seem "out of place" when scanning filesystems. Is that sort of file system inspection something that the trivy team would entertain?

Target

Filesystem

Scanner

Vulnerability

[itaysk]

trivy today can scan a filesystem directory and also some compiled binaries. can you elaborate more on your use case?

[bpmooch]

Could you point me to the documentation that covers what you are referring to here?

For my use case, I am running into customers that feel that scanning packages installed through apt-get or other package managers is not giving them "the full picture" in SBOMs. I apologize for the vague term; the definition of the full picture is a moving target and it's making compliance discussions a pickle in some cases.

To try to ground things a bit, if I compile c code with no external dependencies and install the resulting binary under /opt using rsync or bake it into the root filesystem the image gets built from, what would show up in the trivy SBOM?

Additionally, if you think this line of thinking is a bit of red herring, I'm very open to that feedback. Defining the right "coverage" for an SBOM is a continual discussion that we are having with our partners and our customers.

[itaysk]

Could you point me to the documentation

https://aquasecurity.github.io/trivy/v0.52/docs/supply-chain/attestation/rekor/#non-packaged-binaries
https://aquasecurity.github.io/trivy/v0.52/docs/coverage/language/golang/#go-binaries
https://aquasecurity.github.io/trivy/v0.52/docs/coverage/language/rust/#binaries

if I compile c code with no external dependencies and install the resulting binary under /opt using rsync

In this case it's your responsibility to create an SBOM for your software. even if trivy detected this file, it cannot analyze it.