aquasecurity/trivy - 31 Help Wanted Issues

Open Issues Need Help

feat(java): detect JAR license from the `Plugin-License-Name` manifest attribute (Jenkins plugins) about 19 hours ago

help wanted good first issue

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

--no-color option 20 days ago

help wanted good first issue kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat: add SHA-512 hash support for SBOM formats (CycloneDX and SPDX) about 2 months ago

help wanted good first issue kind/feature scan/sbom

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(maven): add `mirrors` support for settings.xml files about 2 months ago

help wanted kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

fix(nodejs): silently skip package.json files with invalid names 2 months ago

good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Include line numbers in json output 3 months ago

help wanted kind/feature priority/backlog

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Including invocation startTime and endTime in SARIF output 3 months ago

help wanted good first issue kind/feature lifecycle/frozen

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(java): Support for Maven 4 settings.xml 4 months ago

help wanted kind/feature target/filesystem

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

License exceptions with a plus sign 4 months ago

kind/bug help wanted scan/license

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(go): Go 1.26 GOEXPERIMENT version format change causes stdlib version parsing warning 4 months ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(cyclonedx): CVSS v4 ratings missing from CycloneDX vulnerability output 4 months ago

kind/bug help wanted good first issue scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(misconf): support for azurerm_network_interface_security_group_association 5 months ago

good first issue kind/feature scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(misconf): support ID-based references for Azure resources in Terraform 5 months ago

good first issue kind/feature scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

docs: update version endpoint example in client/server documentation 5 months ago

AI Summary: The client/server documentation for the `version` endpoint displays an outdated example response. The current example includes `JavaDB` and `PolicyBundle`, which are no longer returned by the server since #10075, as these are now handled client-side. The documentation needs to be updated to reflect the server's current response, which only contains `VulnerabilityDB` information.

Complexity: 1/5

good first issue kind/documentation

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Add support for `pylock.toml ` (PEP 751) 5 months ago

help wanted kind/feature scan/vulnerability target/filesystem

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(misconf): adapt ARM k8s clusters 5 months ago

good first issue kind/feature scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

refactor(rpc): remove unused Insecure field from ServiceOption 5 months ago

help wanted good first issue kind/cleanup

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

fix: scan `.git/config` for secrets 6 months ago

help wanted scan/secret

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(os): Trivy detects CentOS Stream as CentOS 7 months ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

docs: update binary signature verification instructions for sigstore bundles 7 months ago

help wanted good first issue kind/documentation

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

enhancement(cyclonedx): use `component.evidence.occurrences.location` for filapaths and linenumber 7 months ago

help wanted

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Wrong logs and docs for Photon 5.0. 8 months ago

help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(java): use remote repositories from `settings.xml` for `pom.xml` files 9 months ago

help wanted kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(pip): Trivy doesn’t trim the end-of-range suffix when using the `--detection-priority comprehensive` flag. 9 months ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Trivy incorrectly reports "UNLICENSED" software as "Unencumbered" 9 months ago

kind/bug help wanted good first issue scan/license

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Support Fedora 10 months ago

help wanted kind/feature priority/backlog scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat: add scanning of `/etc/os-release` for RHEL-based images 10 months ago

help wanted good first issue kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(sbom): add CoreOS support 10 months ago

help wanted good first issue kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(alma): add AlmaLinux 10 support 12 months ago

AI Summary: This task involves adding support for AlmaLinux 10 to the Trivy vulnerability scanner. This requires updating the vulnerability database (`vuln-list-update`) to include AlmaLinux 10 advisories, rebuilding the Trivy database (`trivy-db`), and finally updating the Trivy scanner itself to correctly identify and report vulnerabilities in AlmaLinux 10 images. The process involves using various command-line tools and potentially interacting with a BoltDB database.

Complexity: 4/5

help wanted good first issue kind/feature scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Epochs never read from `/var/lib/rpmmanifest/container-manifest-2`. about 1 year ago

AI Summary: The task is to fix a bug in Trivy's RPM package analyzer where it fails to correctly parse epoch information from RPM entries within the `/var/lib/rpmmanifest/container-manifest-2` file. This requires modifying the `rpmqa.go` file to ensure accurate parsing of epoch data from RPM metadata.

Complexity: 4/5

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(license): use separate SPDX ids to ignore SPDX expressions about 1 year ago

AI Summary: The task requires modifying Trivy's license ignore functionality. Currently, Trivy only ignores licenses matching the exact SPDX expression. This issue proposes enhancing it to ignore licenses if all individual SPDX IDs within an expression are present in the ignore list. This involves validating SPDX expressions, splitting them into individual IDs, and using Trivy's existing license matching function for both individual IDs and the full expression.

Complexity: 4/5

help wanted kind/feature scan/license

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners