v0.25.0

[aqua-bot]

🚀 What's new? 🚀

🥏 Add subcommand for SBOM

Trivy now generates SBOM with the dedicated subcommand.

$ trivy sbom alpine:3.15

Note: it supports CycloneDX only, but other formats are coming soon.

If you want to scan the local filesystem, you can use --artifact-type option.

$ trivy sbom --artifact-type fs ./

See here for more details.

Kudos to @tamirkiviti13

🌀 Add vulnerabilities to CycloneDX

Trivy supports CycloneDX 1.4 and adds vulnerabilities.

$ trivy image -f cyclonedx -o result.cdx alpine:3.14.0
$ jq '.vulnerabilities' result.cdx
[
  {
    "id": "CVE-2022-0778",
    "source": {
      "name": "alpine",
      "url": "https://secdb.alpinelinux.org/"
    },
    "ratings": [
      {
        "source": {
          "name": "alma"
        },
        "score": 0,
        "severity": "high"
      },
...(snip)...

Kudos to @masahiro331

🗳️ Filesystem scanning in client/server mode

Trivy scans local filesystem in client/server mode.

$ trivy server

Open another terminal and run a client with the --server flag:

$ trivy fs --server http://localhost:4954 ./

examples/misconf/go-testing/go.sum (gomod)
==========================================
Total: 44 (UNKNOWN: 10, LOW: 2, MEDIUM: 17, HIGH: 12, CRITICAL: 3)

Note: The --server option will be added to trivy image and trivy repo in the next version. Then, trivy client will be deprecated.

See here for more details.

Kudos to @afdesk

🎓 Add version subcommand

trivy version supports JSON format.

$ trivy version -f json
{"Version":"dev","VulnerabilityDB":{"Version":2,"NextUpdate":"2022-03-31T12:08:36.282252527Z","UpdatedAt":"2022-03-31T06:08:36.282252727Z","DownloadedAt":"2022-03-31T08:49:53.506731Z"}}

Kudos to @DmitriyLewen

---

This discussion was created from the release v0.25.0.