simar7

> We discussed this here [aquasecurity/trivy-checks#352](https://github.com/aquasecurity/trivy-checks/pull/352) . By the way, custom fields should be in the `custom` field. For example: > > ``` > # custom: > # minimum_trivy_version: v0.60...

> can you clarify how different scenatios will be handled by this proposal? check foo depends on trivy 0.60. is it compatible with 0.61? probably yes but maybe no. Forward...

> What if we need to update add/update a rule after adding support for a resource/attribute in Trivy or fixing a typo or data type? If we determine the check...

Closed via https://github.com/aquasecurity/trivy/pull/8880

In my original example, if we don't have the value for `${aws_kinesis_stream.stepfunction_ecs_kinesis_stream.arn}"` we also won't be able to evaluate the statement below: ``` { "Effect": "Allow", "Action": [ "kinesis:DescribeStream", "kinesis:GetRecords"...

@knqyf263 @nikpivkin I'm open to ideas if there's a better way to solve this. I've run into this in the past and found it confusing as well, so I decided...

hi @Emyrk sorry for the late response. While I like the idea you have, I'm not sure how beneficial it is to the Trivy project. As for my thoughts on...

> we go to B and download the bundle again since the digest is different. @nikpivkin why would the digest be different when the same artifact is published to different...

Superseded by https://github.com/aquasecurity/trivy/pull/7952

> @simar7 Any examples of what suspicious annotations might look like? @nikpivkin I actually missed an important detail, we should start off with annotations like `auth_url` or any other `url*`...