search

aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
https://aquasecurity.github.io/trivy
Apache License 2.0
22.86k stars 2.25k forks source link

Trivy Java DB as part of server mode #3560

Open computeralex92 opened 1 year ago

computeralex92 commented 1 year ago

Currently the Trivy client itself downloads the Java DB if a java package is detected, regardless if it's configured to use a central server (client / server mode). It would be great if the server is storing the Java DB itself and the client is using it for detecting security issues in java packages; without the need to download the DB on client side.

DaspawnW commented 1 year ago

is there any information / plan when this will be implemented?

Imagine you have a set of hosts where it's running or containers used for trivy vuln scanning this is a huge amount of traffic.

knqyf263 commented 1 year ago

We were thinking about the design and realized that simply putting the DB on the server side would generate a lot of HTTP requests to the server since the DB is accessed sequentially. HTTP requests need to be reduced by aggregating DB access, but this will require significant modifications to the code. We'd say unfortunately it is not coming soon. It's still in our backlog, though.

Instead, you can host the database in your own registry and use --java-db-repository. https://aquasecurity.github.io/trivy/v0.41/docs/scanner/vulnerability/#private-hosting_1

Or download the DB manually and copy it to your machine. https://aquasecurity.github.io/trivy/v0.41/docs/advanced/air-gap/#download-the-java-index-database1

gerbil commented 9 months ago

--skip-db-update --skip-java-db-update - is not working via Trivy operator in client-server mode