trivy
trivy copied to clipboard
aquasecurity
Support Fedora
@urbaniak Thank you for your request. Although I want to support Fedora, I don't know whether Fedora has the security advisory. Trivy needs the security advisory by the distribution to detect vulnerabilities. Let me know if you know anything.
Hello @knqyf263 , I think that you need to use this url to restrict to security : https://bodhi.fedoraproject.org/updates/?type=security It also offers an RSS : https://bodhi.fedoraproject.org/rss/updates/?type=security Fedora has others things about Updates and Security that you can find in the wiki : https://fedoraproject.org/wiki/Security_Bugs#Fedora_Security_Advisories Regards
@colundrum Great! This is valuable information. How many users are using fedora on container?
@knqyf263 statistics for fedora official docker images are here : https://hub.docker.com/v2/repositories/library/fedora/ I read at this time : "pull_count": 49053602
@colundrum Thank you for the information. It's large number. It might be better to support Fedora. Welcome contributor!
@knqyf263 I'm interested in having fedora support as well. I've started debugging trivy CLI in order to have an idea about the architecture.
Can you please provide some high level guidance on how to approach this contributions? Should I start from trivy-db or fanal repository?
Thanks
First of all, we have to parse Fedora security advisories and they need to be committed to vuln-list. https://bodhi.fedoraproject.org/updates/?type=security
The update script must be in vuln-list-update.
But I've not found structured advisories like JSON or YAML yet. Looks like RSS is missing some information such as OS versions. We have to look for it at first.
@mfrancisc Could you open a PR in vuln-list-update? We already have a PR we were working on, but you can open a new one. https://github.com/aquasecurity/vuln-list-update/pull/30/
@knqyf263 I can have a look and see if I can find a way to integrate the missing information (OS versions and others if needed). Should I start from the code in that PR? why was that closed?
whats the status here? seems like fedora is not supported but there already was once a prepared pr for that?
since i'm new to this topic, is this about adding fedora to the "scanable base images" or to have installable rpms for fedora? :D
Seems like https://github.com/aquasecurity/trivy/pull/1616 has been closed for inactivity. Any other news so far?
