aquasecurity/trivy-dbBuild and manage Trivy vulnerability databases by aggregating security advisories from NVD, Red Hat, Debian, and more. A CLI tool and library for database creation, compaction, and distribution.
trivy-dbThe trivy-db CLI tool builds vulnerability DBs. A GitHub Actions workflow
periodically builds a fresh version of the vulnerability DB using trivy-db and uploads it to the GitHub
Container Registry (see Download the vulnerability database below).
NAME:
trivy-db - Trivy DB builder
USAGE:
main [global options] command [command options] image_name
VERSION:
0.0.1
COMMANDS:
build build a database file
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--help, -h show help
--version, -v print the version
To build trivy-db locally, you can use the following order of commands from the Makefile:
make db-fetch-langs db-fetch-vuln-list # To download all advisories and other required files (`./cache` dir by default)
make build # Build `trivy-db` binary
make db-build # Build database (`./out` dir by default)
make db-compact # Compact database (`./assets` dir by default)
make db-compress # Compress database into `db.tar.gz` file
To build trivy-db image and push into registry, you need to use Oras CLI.
For example for ghcr:
./oras push --artifact-type application/vnd.aquasec.trivy.config.v1+json \
"ghcr.io/aquasecurity/trivy-db:2" \
db.tar.gz:application/vnd.aquasec.trivy.db.layer.v1.tar+gzip
Trivy DB is built every 6 hours. By default, the update interval specified in the metadata file is 24 hours. If you need to update Trivy DB more frequently, you can upload a new Trivy DB manually.
Trivy DB v1 reached the end of support on February 2023. Please upgrade Trivy to v0.23.0 or later.
Read more about the Trivy DB v1 deprecation in the discussion.
Trivy DB v2 is hosted on GHCR.
Although GitHub displays the docker pull command by default, please note that it cannot be downloaded using docker pull as it is not a container image.
Trivy:
TRIVY_TEMP_DIR=$(mktemp -d)
trivy --cache-dir $TRIVY_TEMP_DIR image --download-db-only
tar -cf ./db.tar.gz -C $TRIVY_TEMP_DIR/db metadata.json trivy.db
rm -rf $TRIVY_TEMP_DIR
oras >= v0.13.0:
$ oras pull ghcr.io/aquasecurity/trivy-db:2
oras < v0.13.0:
$ oras pull -a ghcr.io/aquasecurity/trivy-db:2
The database can be used for Air-Gapped Environment.