feat(k8s): add support for vulnerability detection (#5268)

Signed-off-by: knqyf263 <knqyf263@gmail.com>
Signed-off-by: chenk <hen.keinan@gmail.com>
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
Co-authored-by: chenk <hen.keinan@gmail.com>

.github/CODEOWNERS

@@ -1,24 +1,15 @@
 # Global
 *   @knqyf263
 
-# Docs
-/docs/** @knqyf263 @AnaisUrlichs @itaysk
-/mkdocs.yml @knqyf263 @AnaisUrlichs @itaysk
-/README.md @knqyf263 @AnaisUrlichs @itaysk
+# Misconfiguration scanning
+docs/docs/scanner/misconfiguration  @knqyf263 @simar7
+docs/docs/target/aws.md             @knqyf263 @simar7
+pkg/fanal/analyzer/config           @knqyf263 @simar7
+pkg/cloud                           @knqyf263 @simar7
 
 # Helm chart
 helm/trivy/ @chen-keinan
 
-# Misconfiguration scanning
-examples/misconf/           @knqyf263
-docs/docs/misconfiguration  @knqyf263
-docs/docs/cloud             @knqyf263
-pkg/fanal/analyzer/config   @knqyf263
-pkg/fanal/handler/misconf   @knqyf263
-pkg/cloud                   @knqyf263
-pkg/flag/aws_flags.go       @knqyf263
-pkg/flag/misconf_flags.go   @knqyf263
-
 # Kubernetes scanning
 pkg/k8s/                @josedonizetti @chen-keinan @knqyf263
 docs/docs/kubernetes/   @josedonizetti @chen-keinan @knqyf263

.github/DISCUSSION_TEMPLATE/adopters.yml

@@ -0,0 +1,31 @@
+title: "<company name>"
+labels: ["adopters"]
+body:
+  - type: textarea
+    id: info
+    attributes:
+      label: "[Optional] How do you use Trivy?"
+    validations:
+      required: false
+  - type: checkboxes
+    attributes:
+      label: "[Optional] Which targets are you scanning with Trivy?"
+      options:
+        - label: "Container Image"
+        - label: "Filesystem"
+        - label: "Git Repository"
+        - label: "Virtual Machine Image"
+        - label: "Kubernetes"
+        - label: "AWS"
+        - label: "SBOM"
+    validations:
+      required: false
+  - type: checkboxes
+    attributes:
+      label: "[Optional] What kind of issues are scanning with Trivy?"
+      options:
+        - label: "Software Bill of Materials (SBOM)"
+        - label: "Known vulnerabilities (CVEs)"
+        - label: "IaC issues and misconfigurations"
+        - label: "Sensitive information and secrets"
+        - label: "Software licenses"

.github/DISCUSSION_TEMPLATE/bugs.yml

@@ -0,0 +1,124 @@
+labels: ["kind/bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        #### Note
+        Feel free to raise a bug report if something doesn't work as expected.
+        Please ensure that you're not creating a duplicate report by searching the [issues](https://github.com/aquasecurity/trivy/issues)/[discussions](https://github.com/aquasecurity/trivy/discussions) beforehand.
+        If you see any false positives or false negatives, please file a ticket [here](https://github.com/aquasecurity/trivy/discussions/new?category=false-detection).
+        
+        **Do not open a GitHub issue, please.** Maintainers triage discussions and then create issues.
+        
+        Please also check [our contribution guidelines](https://aquasecurity.github.io/trivy/latest/community/contribute/discussion/).
+  - type: textarea
+    attributes:
+      label: Description
+      description: Briefly describe the problem you are having in a few paragraphs.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Desired Behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Actual Behavior
+      description: What happened instead?
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reproduction Steps
+      description: How do you trigger this bug? Please walk us through it step by step.
+      value: |
+        1.
+        2.
+        3.
+        ...
+      render: bash
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: Target
+      description: Which target are you scanning? It is equal to which subcommand you are using.
+      options:
+        - Container Image
+        - Filesystem
+        - Git Repository
+        - Virtual Machine Image
+        - Kubernetes
+        - AWS
+        - SBOM
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: Scanner
+      description: Which scanner are you using?
+      options:
+        - Vulnerability
+        - Misconfiguration
+        - Secret
+        - License
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: Output Format
+      description: Which output format are you using?
+      options:
+        - Table
+        - JSON
+        - Template
+        - SARIF
+        - CycloneDX
+        - SPDX
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: Mode
+      description: Which mode are you using? Specify "Standalone" if you are not using `trivy server`.
+      options:
+        - Standalone
+        - Client/Server
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Debug Output
+      description: Output of run with `--debug`
+      placeholder: "$ trivy <target> <subject> --debug"
+      render: bash
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: Operating System
+      description: On what operating system are you running Trivy?
+      placeholder: "e.g. macOS Big Sur"
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Version
+      description: Output of `trivy --version`
+      placeholder: "$ trivy --version"
+      render: bash
+    validations:
+      required: true
+  - type: checkboxes
+    attributes:
+      label: Checklist
+      description: Have you tried the following?
+      options:
+        - label: Run `trivy image --reset`
+        - label: Read [the troubleshooting](https://aquasecurity.github.io/trivy/latest/docs/references/troubleshooting/)
+  - type: markdown
+    attributes:
+      value: |
+        We would be happy if you could share how you are using Trivy [here](https://github.com/aquasecurity/trivy/discussions/new?category=adopters).

.github/DISCUSSION_TEMPLATE/documentation.yml

@@ -0,0 +1,28 @@
+labels: ["kind/documentation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        #### Note
+        Feel free to create a docs report if something doesn't work as expected or is unclear in the documentation.
+        Please ensure that you're not creating a duplicate report by searching the [issues](https://github.com/aquasecurity/trivy/issues)/[discussions](https://github.com/aquasecurity/trivy/discussions) beforehand.
+        
+        Please also check [our contribution guidelines](https://aquasecurity.github.io/trivy/latest/community/contribute/discussion/).
+  - type: textarea
+    attributes:
+      label: Description
+      description: Briefly describe the what has been unclear in the existing documentation
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Link
+      description: Please provide a link to the current documentation or where you thought to find the information you were looking for
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Suggestions
+      description: What would you like to have added or changed in the documentation?
+    validations:
+      required: true

.github/DISCUSSION_TEMPLATE/false-detection.yml

@@ -0,0 +1,96 @@
+body:
+  - type: markdown
+    attributes:
+      value: |
+        #### Note
+        Feel free to raise a bug report if something doesn't work as expected.
+        Please ensure that you're not creating a duplicate report by searching the [issues](https://github.com/aquasecurity/trivy/issues)/[discussions](https://github.com/aquasecurity/trivy/discussions) beforehand.
+        
+        **Do not open a GitHub issue, please.** Maintainers triage discussions and then create issues.
+        
+        Please also check [our contribution guidelines](https://aquasecurity.github.io/trivy/latest/community/contribute/discussion/).
+  - type: input
+    attributes:
+      label: IDs
+      description: List the IDs of vulnerabilities, misconfigurations, secrets, or licenses that are either not detected or mistakenly detected.
+      placeholder: "e.g. CVE-2021-44228, CVE-2022-22965"
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Description
+      description: Describe the false detection.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reproduction Steps
+      description: How do you trigger this bug? Please walk us through it step by step.
+      value: |
+        1.
+        2.
+        3.
+        ...
+      render: bash
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: Target
+      description: Which target are you scanning? It is equal to which subcommand you are using.
+      options:
+        - Container Image
+        - Filesystem
+        - Git Repository
+        - Virtual Machine Image
+        - Kubernetes
+        - AWS
+        - SBOM
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: Scanner
+      description: Which scanner are you using?
+      options:
+        - Vulnerability
+        - Misconfiguration
+        - Secret
+        - License
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: Target OS
+      description: What operating system are you scanning? Fill in this field if the scanning target is an operating system.
+      placeholder: "Example: Ubuntu 22.04"
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Debug Output
+      description: Output of run with `--debug`
+      placeholder: "$ trivy <target> <subject> --debug"
+      render: bash
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Version
+      description: Output of `trivy --version`
+      placeholder: "$ trivy --version"
+      render: bash
+    validations:
+      required: true
+  - type: checkboxes
+    attributes:
+      label: Checklist
+      options:
+        - label: Read [the documentation regarding wrong detection](https://aquasecurity.github.io/trivy/dev/community/contribute/discussion/#false-detection)
+        - label: Ran Trivy with `-f json` that shows data sources and confirmed that the security advisory in data sources was correct
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: |
+        We would be happy if you could share how you are using Trivy [here](https://github.com/aquasecurity/trivy/discussions/new?category=adopters).

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -0,0 +1,47 @@
+labels: ["kind/feature"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        #### Note
+        Feel free to share your idea.
+        Please ensure that you're not creating a duplicate ticket by searching the [issues](https://github.com/aquasecurity/trivy/issues)/[discussions](https://github.com/aquasecurity/trivy/discussions) beforehand.
+        
+        **Do not open a GitHub issue, please.** Maintainers triage discussions and then create issues.
+        
+        Please also check [our contribution guidelines](https://aquasecurity.github.io/trivy/latest/community/contribute/discussion/).
+  - type: textarea
+    attributes:
+      label: Description
+      description: Describe your idea.
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: Target
+      description: Which target is your idea related to?
+      options:
+        - Container Image
+        - Filesystem
+        - Git Repository
+        - Virtual Machine Image
+        - Kubernetes
+        - AWS
+        - SBOM
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: Scanner
+      description: Which scanner is your idea related to?
+      options:
+        - Vulnerability
+        - Misconfiguration
+        - Secret
+        - License
+    validations:
+      required: false
+  - type: markdown
+    attributes:
+      value: |
+        We would be happy if you could share how you are using Trivy [here](https://github.com/aquasecurity/trivy/discussions/new?category=adopters).

.github/DISCUSSION_TEMPLATE/q-a.yml

@@ -0,0 +1,84 @@
+labels: ["triage/support"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        #### Note
+        If you have any troubles/questions, feel free to ask.
+        Please ensure that you're not asking a duplicate question by searching the [issues](https://github.com/aquasecurity/trivy/issues)/[discussions](https://github.com/aquasecurity/trivy/discussions) beforehand.
+        
+        **Do not open a GitHub issue, please.** Maintainers triage discussions and then create issues.
+        
+        Please also check [our contribution guidelines](https://aquasecurity.github.io/trivy/latest/community/contribute/discussion/).
+  - type: textarea
+    attributes:
+      label: Question
+      description: What kind of problem are you facing? Or, what questions do you have?
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: Target
+      description: Which target are you scanning? It is equal to which subcommand you are using.
+      options:
+        - Container Image
+        - Filesystem
+        - Git Repository
+        - Virtual Machine Image
+        - Kubernetes
+        - AWS
+        - SBOM
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: Scanner
+      description: Which scanner are you using?
+      options:
+        - Vulnerability
+        - Misconfiguration
+        - Secret
+        - License
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: Output Format
+      description: Which output format are you using?
+      options:
+        - Table
+        - JSON
+        - Template
+        - SARIF
+        - CycloneDX
+        - SPDX
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: Mode
+      description: Which mode are you using? Specify "Standalone" if you are not using `trivy server`.
+      options:
+        - Standalone
+        - Client/Server
+    validations:
+      required: false
+  - type: input
+    attributes:
+      label: Operating System
+      description: What operating system are you using?
+      placeholder: "Example: macOS Big Sur"
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Version
+      description: Output of `trivy --version`
+      placeholder: "$ trivy --version"
+      render: bash
+    validations:
+      required: false
+  - type: markdown
+    attributes:
+      value: |
+        We would be happy if you could share how you are using Trivy [here](https://github.com/aquasecurity/trivy/discussions/new?category=adopters.

.github/DISCUSSION_TEMPLATE/show-and-tell.yml

@@ -1,53 +0,0 @@
-title: "<company name> "
-labels: ["adopters"]
-body:
-  - type: textarea
-    id: links
-    attributes:
-      label: "Share Links"
-      description: "If you would like to share a link to your project or company, please paste it below 🌐"
-      value: |
-        ...
-    validations:
-      required: false
-  - type: textarea
-    id: logo
-    attributes:
-      label: "Share Logo"
-      description: "If you have a link to your logo, please provide it in the following text-box 🌐"
-      value: |
-        ...
-    validations:
-      required: false
-  - type: checkboxes
-    attributes:
-      label: Please select all the scan targets that you are using
-      options:
-        - label: Container Images
-        - label: Filesystem
-        - label: Git Repository
-        - label: Virtual Machine Images
-        - label: Kubernetes
-        - label: AWS
-    validations:
-      required: false
-  - type: checkboxes
-    attributes:
-      label: Which scanners are you using on those scan targets?
-      options:
-        - label: OS packages and software dependencies in use (SBOM)
-        - label: Known vulnerabilities (CVEs)
-        - label: IaC issues and misconfigurations
-        - label: Sensitive information and secrets
-        - label: Software licenses
-    validations:
-      required: false
-  - type: textarea
-    id: info
-    attributes:
-      label: "Additional Information"
-      description: "Please tell us more about your use case of Trivy -- anything that you would like to share 🎉"
-      value: |
-        ...
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/BUG_REPORT.md

@@ -1,31 +0,0 @@
----
-name: Bug Report
-labels: kind/bug
-about: If something isn't working as expected.
----
-
-## Description
-
-<!--
-Briefly describe the problem you are having in a few paragraphs.
--->
-
-## What did you expect to happen?
-
-
-## What happened instead?
-
-
-## Output of run with `-debug`:
-
-```
-(paste your output here)
-```
-
-## Output of `trivy -v`:
-
-```
-(paste your output here)
-```
-
-## Additional details (base image name, container registry info...):

.github/ISSUE_TEMPLATE/FEATURE_REQUEST.md

@@ -1,9 +0,0 @@
----
-name: Feature Request
-labels: kind/feature
-about: I have a suggestion (and might want to implement myself)!
----
-
-<!--
-If this is a FEATURE REQUEST, request format does not matter!
--->

.github/ISSUE_TEMPLATE/SUPPORT_QUESTION.md

@@ -1,10 +0,0 @@
----
-name: Support Question
-labels: triage/support
-about: If you have a question about Trivy.
----
-
-<!--
-If you have a trouble, feel free to ask.
-Make sure you're not asking duplicate question by searching on the issues lists.
--->

.github/ISSUE_TEMPLATE/WRONG_DETECTION.md

@@ -1,33 +0,0 @@
----
-name: Wrong Detection
-labels: ["kind/bug"]
-about: If Trivy doesn't detect something, or shows false positive detection
----
-
-## Checklist
-- [ ] I've read [the documentation regarding wrong detection](https://aquasecurity.github.io/trivy/latest/community/contribute/issue/#wrong-detection).
-- [ ] I've confirmed that a security advisory in data sources was correct.
-    - Run Trivy with `-f json` that shows data sources and make sure that the security advisory is correct.
-
-
-## Description
-
-<!--
-Briefly describe the CVE that aren't detected and information about artifacts with this CVE.
--->
-
-## JSON Output of run with `-debug`:
-
-```
-(paste your output here)
-```
-
-## Output of `trivy -v`:
-
-```
-(paste your output here)
-```
-
-## Additional details (base image name, container registry info...):
-
-

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,17 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a false detection
+    url: https://github.com/aquasecurity/trivy/discussions/new?category=false-detection
+    about: Report false positives/negatives
+  - name: Report a bug
+    url: https://github.com/aquasecurity/trivy/discussions/new?category=bugs
+    about: Report bugs
+  - name: Enhance documentation
+    url: https://github.com/aquasecurity/trivy/discussions/new?category=documentation
+    about: Make suggestions to the documentation
+  - name: Request a feature enhancement
+    url: https://github.com/aquasecurity/trivy/discussions/new?category=ideas
+    about: Share ideas for new features
+  - name: Ask the community for help
+    url: https://github.com/aquasecurity/trivy/discussions/new?category=q-a
+    about: Ask questions and discuss with other community members

.github/workflows/auto-close-issue.yaml

@@ -0,0 +1,46 @@
+name: Auto-close issues
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  close_issue:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close issue if user does not have write or admin permissions
+        uses: actions/github-script@v6
+        with:
+          script: |
+            // Get the issue creator's username
+            const issueCreator = context.payload.issue.user.login;
+            
+            // Check the user's permissions for the repository
+            const repoPermissions = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              username: issueCreator
+            });
+            
+            const permission = repoPermissions.data.permission;
+            
+            // If the user does not have write or admin permissions, leave a comment and close the issue
+            if (permission !== 'write' && permission !== 'admin') {
+              const commentBody = "Please see https://aquasecurity.github.io/trivy/latest/community/contribute/issue/";
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                body: commentBody
+              });
+            
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                state: 'closed',
+                state_reason: 'not_planned'
+              });
+            
+              console.log(`Issue #${context.payload.issue.number} closed because ${issueCreator} does not have sufficient permissions.`);
+            }

.github/workflows/auto-update-labels.yaml

@@ -0,0 +1,30 @@
+name: Auto-update labels
+on:
+  push:
+    paths:
+      - 'misc/triage/labels.yaml'
+    branches:
+      - main
+
+jobs:
+  deploy:
+    name: Auto-update labels
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4.1.0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: go.mod
+
+      - name: Install aqua tools
+        uses: aquaproj/aqua-installer@v2.1.2
+        with:
+          aqua_version: v1.25.0
+
+      - name: update labels
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: mage label

.github/workflows/bypass-cla.yaml

@@ -0,0 +1,12 @@
+# This workflow is used to bypass the required status checks in merge queue.
+# cf. https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/troubleshooting-required-status-checks
+name: CLA
+on:
+  merge_group:
+
+jobs:
+  cla:
+    name: license/cla
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No test required"'

.github/workflows/bypass-test.yaml

@@ -0,0 +1,31 @@
+# This workflow is used to bypass the required status checks.
+# cf. https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/troubleshooting-required-status-checks
+name: Test
+on:
+  push:
+    paths:
+      - '**.md'
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'LICENSE'
+  pull_request:
+    paths:
+      - '**.md'
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'LICENSE'
+jobs:
+  test:
+    name: Test
+    runs-on: ${{ matrix.operating-system }}
+    strategy:
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - run: 'echo "No test required"'
+
+  integration:
+    name: Integration Test
+    runs-on: ubuntu-latest
+    steps:
+      - run: 'echo "No test required"'

.github/workflows/canary.yaml

@@ -16,7 +16,7 @@ jobs:
     uses: ./.github/workflows/reusable-release.yaml
     with:
       goreleaser_config: goreleaser-canary.yml
-      goreleaser_options: '--snapshot --rm-dist --timeout 60m' # will not release
+      goreleaser_options: '--snapshot --clean --timeout 60m' # will not release
     secrets: inherit
 
   upload-binaries:
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Restore Trivy binaries from cache
-        uses: actions/cache@v3.2.2
+        uses: actions/cache@v3.3.2
         with:
           path: dist/
           key: ${{ runner.os }}-bins-${{github.workflow}}-${{github.sha}}

.github/workflows/check-go-versions.yaml

@@ -0,0 +1,31 @@
+name: Check Go versions of dependencies
+on:
+  pull_request:
+    paths:
+      - 'go.mod'
+  workflow_dispatch:
+
+jobs:
+  check-go-versions:
+    name: Check Go versions of dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v4.1.0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: stable
+
+      # This workflow is a workaround before the "old stable" version becomes Go 1.21.
+      # To avoid updating dependencies that require Go 1.21, we use this workflow
+      # Example of wrong update:
+      # https://github.com/aquasecurity/trivy/discussions/5323#discussioncomment-7186321
+      - name: Check that dependencies doesn't require Go 1.21
+        run: |
+          go mod tidy
+          if grep -q "go 1.21" go.mod; then
+            echo "One of new dependencies requires Go '1.21'. Use 'go get go@1.20' to fix this."
+            exit 1
+          fi

.github/workflows/mkdocs-dev.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout main
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
         with:
           fetch-depth: 0
           persist-credentials: true

.github/workflows/mkdocs-latest.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout main
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
         with:
           fetch-depth: 0
           persist-credentials: true

.github/workflows/publish-chart.yaml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        uses: actions/checkout@v4.1.0
         with:
           fetch-depth: 0
       - name: Install Helm
@@ -35,9 +35,9 @@ jobs:
           python-version: 3.7
       - name: Setup Chart Linting
         id: lint
-        uses: helm/chart-testing-action@afea100a513515fbd68b0e72a7bb0ae34cb62aec
+        uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76
       - name: Setup Kubernetes cluster (KIND)
-        uses: helm/kind-action@d8ccf8fb623ce1bb360ae2f45f323d9d5c5e9f00
+        uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140
         with:
           version: ${{ env.KIND_VERSION }}
           image: ${{ env.KIND_IMAGE }}
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        uses: actions/checkout@v4.1.0
         with:
           fetch-depth: 0
       - name: Install chart-releaser

.github/workflows/release.yaml

@@ -10,7 +10,7 @@ jobs:
     uses: ./.github/workflows/reusable-release.yaml
     with:
       goreleaser_config: goreleaser.yml
-      goreleaser_options: '--rm-dist --timeout 90m'
+      goreleaser_options: '--clean --timeout 90m'
     secrets: inherit
 
   deploy-packages:
@@ -19,12 +19,12 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
         with:
           fetch-depth: 0
 
       - name: Restore Trivy binaries from cache
-        uses: actions/cache@v3.2.2
+        uses: actions/cache@v3.3.2
         with:
           path: dist/
           key: ${{ runner.os }}-bins-${{github.workflow}}-${{github.sha}}
@@ -35,7 +35,7 @@ jobs:
           sudo apt-get -y install rpm reprepro createrepo-c distro-info
 
       - name: Checkout trivy-repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
         with:
           repository: ${{ github.repository_owner }}/trivy-repo
           path: trivy-repo

.github/workflows/reusable-release.yaml

@@ -26,68 +26,90 @@ jobs:
       packages: write # For GHCR
       contents: read  # Not required for public repositories, but for clarity
     steps:
+      - name: Maximize build space
+        uses: easimon/maximize-build-space@v8
+        with:
+          root-reserve-mb: 35840 # The Go cache (`~/.cache/go-build` and `~/go/pkg`) requires a lot of storage space.
+          remove-android: 'true'
+          remove-docker-images: 'true'
+          remove-dotnet: 'true'
+          remove-haskell: 'true'
+
       - name: Cosign install
-        uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b
+        uses: sigstore/cosign-installer@4a861528be5e691840a69536975ada1d4c30349d
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Show available Docker Buildx platforms
         run: echo ${{ steps.buildx.outputs.platforms }}
 
       - name: Login to docker.io registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to ghcr.io registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ env.GH_USER }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to ECR
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: public.ecr.aws
           username: ${{ secrets.ECR_ACCESS_KEY_ID }}
           password: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
 
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
         with:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
         with:
           go-version-file: go.mod
 
       - name: Generate SBOM
-        uses: CycloneDX/gh-gomod-generate-sbom@v1
+        uses: CycloneDX/gh-gomod-generate-sbom@v2
         with:
           args: mod -licenses -json -output bom.json
           version: ^v1
 
+      - name: "save gpg key"
+        env:
+          GPG_KEY: ${{ secrets.GPG_KEY }}
+        run: |
+          echo "$GPG_KEY" > gpg.key
+
       - name: GoReleaser
         uses: goreleaser/goreleaser-action@v4
         with:
-          version: v1.4.1
+          version: v1.20.0
           args: release -f=${{ inputs.goreleaser_config}} ${{ inputs.goreleaser_options}}
         env:
           GITHUB_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
+          NFPM_DEFAULT_RPM_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_FILE: "gpg.key"
 
-      ## push images to registries
-      ## only for canary build
+      - name: "remove gpg key"
+        run: |
+          rm gpg.key
+
+      # Push images to registries (only for canary build)
+      # The custom Dockerfile.canary is necessary
+      # because GoReleaser Free doesn't support pushing images with the `--snapshot` flag.
       - name: Build and push
         if: ${{ inputs.goreleaser_config == 'goreleaser-canary.yml' }}
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           platforms: linux/amd64, linux/arm64
           file: ./Dockerfile.canary # path to Dockerfile
@@ -99,7 +121,7 @@ jobs:
             public.ecr.aws/aquasecurity/trivy:canary
 
       - name: Cache Trivy binaries
-        uses: actions/cache@v3.2.2
+        uses: actions/cache@v3.3.2
         with:
           path: dist/
           # use 'github.sha' to create a unique cache folder for each run.

.github/workflows/roadmap.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # 'kind/feature' AND 'priority/backlog' labels -> 'Backlog' column
-      - uses: actions/add-to-project@v0.4.0 # add new issue to project
+      - uses: actions/add-to-project@v0.4.1 # add new issue to project
         with:
           project-url: https://github.com/orgs/aquasecurity/projects/25
           github-token: ${{ secrets.ORG_PROJECT_TOKEN }}
@@ -28,7 +28,7 @@ jobs:
           field-values: Backlog
 
       # 'kind/feature' AND 'priority/important-longterm' labels -> 'Important (long-term)' column
-      - uses: actions/add-to-project@v0.4.0 # add new issue to project
+      - uses: actions/add-to-project@v0.4.1 # add new issue to project
         with:
           project-url: https://github.com/orgs/aquasecurity/projects/25
           github-token: ${{ secrets.ORG_PROJECT_TOKEN }}
@@ -45,7 +45,7 @@ jobs:
           field-values: Important (long-term)
 
       # 'kind/feature' AND 'priority/important-soon' labels -> 'Important (soon)' column
-      - uses: actions/add-to-project@v0.4.0 # add new issue to project
+      - uses: actions/add-to-project@v0.4.1 # add new issue to project
         with:
           project-url: https://github.com/orgs/aquasecurity/projects/25
           github-token: ${{ secrets.ORG_PROJECT_TOKEN }}
@@ -62,7 +62,7 @@ jobs:
           field-values: Important (soon)
 
       # 'kind/feature' AND 'priority/critical-urgent' labels -> 'Urgent' column
-      - uses: actions/add-to-project@v0.4.0 # add new issue to project
+      - uses: actions/add-to-project@v0.4.1 # add new issue to project
         with:
           project-url: https://github.com/orgs/aquasecurity/projects/25
           github-token: ${{ secrets.ORG_PROJECT_TOKEN }}

.github/workflows/scan.yaml

@@ -10,14 +10,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
 
       - name: Run Trivy vulnerability scanner and create GitHub issues
-        uses: knqyf263/trivy-issue-action@v0.0.4
+        uses: knqyf263/trivy-issue-action@v0.0.5
         with:
           assignee: knqyf263
           severity: CRITICAL
-          skip-dirs: integration,examples
+          skip-dirs: integration,examples,pkg
           label: kind/security
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/semantic-pr.yaml

@@ -47,6 +47,7 @@ jobs:
 
             alpine
             wolfi
+            chainguard
             redhat
             alma
             rocky
@@ -69,9 +70,11 @@ jobs:
             java
             go
             c
-            c++
+            c\+\+
             elixir
             dart
+            swift
+            bitnami
 
             os
             lang
@@ -92,6 +95,7 @@ jobs:
             cyclonedx
             spdx
             purl
+            vex
 
             helm
             report

.github/workflows/stale-issues.yaml

@@ -1,4 +1,4 @@
-name: "Stale issues"
+name: "Stale PR's"
 on:
   schedule:
     - cron: '0 0 * * *'
@@ -7,14 +7,13 @@ jobs:
     timeout-minutes: 1
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v7
+    - uses: actions/stale@v8
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-issue-message: 'This issue is stale because it has been labeled with inactivity.'
         stale-pr-message: 'This PR is stale because it has been labeled with inactivity.'
-        exempt-issue-labels: 'lifecycle/frozen,lifecycle/active,priority/critical-urgent,priority/important-soon,priority/important-longterm,priority/backlog,priority/awaiting-more-evidence'
         exempt-pr-labels: 'lifecycle/active'
         stale-pr-label: 'lifecycle/stale'
-        stale-issue-label: 'lifecycle/stale'
         days-before-stale: 60
+        days-before-issue-stale: '-1'
         days-before-close: 20
+        days-before-issue-close: '-1'

.github/workflows/test-docs.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4.1.0
       with:
         fetch-depth: 0
         persist-credentials: true

.github/workflows/test.yaml

@@ -1,19 +1,12 @@
 name: Test
 on:
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - 'mkdocs.yml'
-      - 'LICENSE'
   pull_request:
       paths-ignore:
       - '**.md'
       - 'docs/**'
       - 'mkdocs.yml'
       - 'LICENSE'
+  merge_group:
 jobs:
   test:
     name: Test
@@ -21,14 +14,13 @@ jobs:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        go-version: [stable, oldstable]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version: oldstable
 
       - name: go mod tidy
         run: |
@@ -40,85 +32,169 @@ jobs:
         if: matrix.operating-system == 'ubuntu-latest'
 
       - name: Lint
-        uses: golangci/golangci-lint-action@v3.3.0
+        id: lint
+        uses: golangci/golangci-lint-action@v3.7.0
         with:
-          version: v1.49
-          args: --deadline=30m
+          version: v1.54
+          args: --deadline=30m --out-format=line-number
           skip-cache: true # https://github.com/golangci/golangci-lint-action/issues/244#issuecomment-1052197778
         if: matrix.operating-system == 'ubuntu-latest'
 
-      # Install tools
-      - uses: aquaproj/aqua-installer@v1.2.0
+      - name: Check if linter failed
+        run: |
+          echo "Linter failed, running 'mage lint:fix' might help to correct some errors"
+          exit 1
+        if: ${{ failure() && steps.lint.conclusion == 'failure' }}
+
+      - name: Install tools
+        uses: aquaproj/aqua-installer@v2.1.2
         with:
           aqua_version: v1.25.0
+          aqua_opts: ""
+
+      - name: Check if CLI references are up-to-date
+        run: |
+          mage docs:generate
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Run 'mage docs:generate' and push it"
+            exit 1
+          fi
+        if: matrix.operating-system == 'ubuntu-latest'
 
       - name: Run unit tests
-        run: make test
+        run: mage test:unit
 
   integration:
     name: Integration Test
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
         with:
           go-version-file: go.mod
 
+      - name: Install tools
+        uses: aquaproj/aqua-installer@v2.1.2
+        with:
+          aqua_version: v1.25.0
+
       - name: Run integration tests
-        run: make test-integration
+        run: mage test:integration
+
+  k8s-integration:
+    name: K8s Integration Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v4.1.0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: go.mod
+
+      - name: Install tools
+        uses: aquaproj/aqua-installer@v2.1.2
+        with:
+          aqua_version: v1.25.0
+
+      - name: Run k8s integration tests
+        run: mage test:k8s
 
   module-test:
     name: Module Integration Test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
         with:
           go-version-file: go.mod
 
-      # Install tools
-      - uses: aquaproj/aqua-installer@v1.1.2
+      - name: Install tools
+        uses: aquaproj/aqua-installer@v2.1.2
         with:
           aqua_version: v1.25.0
 
       - name: Run module integration tests
         shell: bash
         run: |
-          make test-module-integration
+          mage test:module
+
+  vm-test:
+    name: VM Integration Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Maximize build space
+        uses: easimon/maximize-build-space@v8
+        with:
+          root-reserve-mb: 35840 # The Go cache (`~/.cache/go-build` and `~/go/pkg`) requires a lot of storage space.
+          remove-android: 'true'
+          remove-docker-images: 'true'
+          remove-dotnet: 'true'
+          remove-haskell: 'true'
+
+      - name: Checkout
+        uses: actions/checkout@v4.1.0
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: go.mod
+      - name: Install tools
+        uses: aquaproj/aqua-installer@v2.1.2
+        with:
+          aqua_version: v1.25.0
+      - name: Run vm integration tests
+        run: |
+          mage test:vm
 
   build-test:
     name: Build Test
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.operating-system }}
+    strategy:
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest, macos-latest]
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v2
-
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v2
-
-    - name: Show available Docker Buildx platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Maximize build space
+      uses: easimon/maximize-build-space@v8
+      with:
+        root-reserve-mb: 35840 # The Go cache (`~/.cache/go-build` and `~/go/pkg`) requires a lot of storage space.
+        remove-android: 'true'
+        remove-docker-images: 'true'
+        remove-dotnet: 'true'
+        remove-haskell: 'true'
+      if: matrix.operating-system == 'ubuntu-latest'
 
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4.1.0
 
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v4
       with:
         go-version-file: go.mod
 
+    - name: Determine GoReleaser ID
+      id: goreleaser_id
+      shell: bash
+      run: |
+        if [ "${{ matrix.operating-system }}" == "windows-latest" ]; then
+          echo "id=--id build-windows" >> $GITHUB_OUTPUT
+        elif [ "${{ matrix.operating-system }}" == "macos-latest" ]; then
+          echo "id=--id build-macos --id build-bsd" >> $GITHUB_OUTPUT
+        else
+          echo "id=--id build-linux" >> $GITHUB_OUTPUT
+        fi
+
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v4
       with:
-        version: v1.4.1
-        args: release --skip-sign --snapshot --rm-dist --skip-publish --timeout 90m
-
+        version: v1.20.0
+        args: build --snapshot --clean --timeout 90m ${{ steps.goreleaser_id.outputs.id }}

.github/workflows/vm-test.yaml

@@ -1,32 +0,0 @@
-name: VM Test
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'pkg/fanal/vm/**'
-      - 'pkg/fanal/walker/vm.go'
-      - 'pkg/fanal/artifact/vm/**'
-      - 'integration/vm_test.go'
-  pull_request:
-    paths:
-      - 'pkg/fanal/vm/**'
-      - 'pkg/fanal/walker/vm.go'
-      - 'pkg/fanal/artifact/vm/**'
-      - 'integration/vm_test.go'
-
-jobs:
-  vm-test:
-    name: VM Integration Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version-file: go.mod
-      - name: Run vm integration tests
-        run: |
-          make test-vm-integration

.gitignore

@@ -34,4 +34,8 @@ integration/testdata/fixtures/vm-images
 dist
 
 # WebAssembly
-*.wasm
+*.wasm
+
+# Signing
+gpg.key
+cmd/trivy/trivy

.golangci.yaml

@@ -17,14 +17,54 @@ linters-settings:
     min-occurrences: 3
   misspell:
     locale: US
-  goimports:
-    local-prefixes: github.com/aquasecurity
+    ignore-words:
+      - licence
   gosec:
     excludes:
       - G101
       - G114
       - G204
       - G402
+  gci:
+    sections:
+      - standard
+      - default
+      - prefix(github.com/aquasecurity/)
+      - blank
+      - dot
+  gomodguard:
+    blocked:
+      modules:
+        - github.com/hashicorp/go-version:
+            recommendations:
+              - github.com/aquasecurity/go-version
+            reason: "`aquasecurity/go-version` is designed for our use-cases"
+        - github.com/Masterminds/semver:
+            recommendations:
+              - github.com/aquasecurity/go-version
+            reason: "`aquasecurity/go-version` is designed for our use-cases"
+  gocritic:
+    disabled-checks:
+      - appendAssign
+      - unnamedResult
+      - whyNoLint
+      - indexAlloc
+      - octalLiteral
+      - hugeParam
+      - rangeValCopy
+      - regexpSimplify
+      - sloppyReassign
+      - commentedOutCode
+    enabled-tags:
+      - diagnostic
+      - style
+      - performance
+      - experimental
+      - opinionated
+    settings:
+      ruleguard:
+        failOn: all
+        rules: '${configDir}/misc/lint/rules.go'
 
 linters:
   disable-all: true
@@ -39,14 +79,18 @@ linters:
     - goconst
     - gocyclo
     - gofmt
-    - goimports
     - misspell
+    - bodyclose
+    - gci
+    - gomodguard
+    - tenv
+    - gocritic
 
 run:
-  go: 1.19
+  go: '1.20'
   skip-files:
-    - ".*._mock.go$"
-    - ".*._test.go$"
+    - ".*_mock.go$"
+    - ".*_test.go$"
     - "integration/*"
     - "examples/*"
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.17.0
+FROM alpine:3.18.4
 RUN apk --no-cache add ca-certificates git
 COPY trivy /usr/local/bin/trivy
 COPY contrib/*.tpl contrib/

Dockerfile.canary

@@ -1,10 +1,11 @@
-FROM alpine:3.17.0
+FROM alpine:3.18.4
 RUN apk --no-cache add ca-certificates git
 
 # binaries were created with GoReleaser
 # need to copy binaries from folder with correct architecture
 # example architecture folder: dist/trivy_canary_build_linux_arm64/trivy
+# GoReleaser adds _v* to the folder name, but only when GOARCH is amd64 
 ARG TARGETARCH
-COPY "dist/trivy_canary_build_linux_${TARGETARCH}/trivy" /usr/local/bin/trivy
+COPY "dist/trivy_canary_build_linux_${TARGETARCH}*/trivy" /usr/local/bin/trivy
 COPY contrib/*.tpl contrib/
 ENTRYPOINT ["trivy"]

Dockerfile.protoc

@@ -1,12 +1,20 @@
-FROM golang:1.19
+FROM --platform=linux/amd64 golang:1.20
 
-# Install protoc (cf. http://google.github.io/proto-lens/installing-protoc.html)
+# Set environment variable for protoc
 ENV PROTOC_ZIP=protoc-3.19.4-linux-x86_64.zip
-RUN apt-get update && apt-get install -y unzip
+
+# Install unzip for protoc installation and clean up cache
+RUN apt-get update && apt-get install -y unzip && rm -rf /var/lib/apt/lists/*
+
+# Download and install protoc
 RUN curl --retry 5 -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.19.4/$PROTOC_ZIP \
     && unzip -o $PROTOC_ZIP -d /usr/local bin/protoc \
-    && unzip -o $PROTOC_ZIP -d /usr/local 'include/*' \ 
+    && unzip -o $PROTOC_ZIP -d /usr/local 'include/*' \
     && rm -f $PROTOC_ZIP
 
+# Install Go tools
 RUN go install github.com/twitchtv/twirp/protoc-gen-twirp@v8.1.0
 RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.27.1
+RUN go install github.com/magefile/mage@v1.14.0
+
+ENV TRIVY_PROTOC_CONTAINER=true

Makefile

@@ -1,135 +0,0 @@
-VERSION := $(patsubst v%,%,$(shell git describe --tags --always)) #Strips the v prefix from the tag
-LDFLAGS := -ldflags "-s -w -X=main.version=$(VERSION)"
-
-GOPATH := $(firstword $(subst :, ,$(shell go env GOPATH)))
-GOBIN := $(GOPATH)/bin
-GOSRC := $(GOPATH)/src
-
-TEST_MODULE_DIR := pkg/module/testdata
-TEST_MODULE_SRCS := $(wildcard $(TEST_MODULE_DIR)/*/*.go)
-TEST_MODULES := $(patsubst %.go,%.wasm,$(TEST_MODULE_SRCS))
-
-EXAMPLE_MODULE_DIR := examples/module
-EXAMPLE_MODULE_SRCS := $(wildcard $(EXAMPLE_MODULE_DIR)/*/*.go)
-EXAMPLE_MODULES := $(patsubst %.go,%.wasm,$(EXAMPLE_MODULE_SRCS))
-
-MKDOCS_IMAGE := aquasec/mkdocs-material:dev
-MKDOCS_PORT := 8000
-
-export CGO_ENABLED := 0 
-
-u := $(if $(update),-u)
-
-# Tools
-$(GOBIN)/wire:
-	go install github.com/google/wire/cmd/wire@v0.5.0
-
-$(GOBIN)/crane:
-	go install github.com/google/go-containerregistry/cmd/crane@v0.9.0
-
-$(GOBIN)/golangci-lint:
-	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b $(GOBIN) v1.49.0
-
-$(GOBIN)/labeler:
-	go install github.com/knqyf263/labeler@latest
-
-$(GOBIN)/easyjson:
-	go install github.com/mailru/easyjson/...@v0.7.7
-
-.PHONY: wire
-wire: $(GOBIN)/wire
-	wire gen ./pkg/commands/... ./pkg/rpc/...
-
-.PHONY: mock
-mock: $(GOBIN)/mockery
-	mockery -all -inpkg -case=snake -dir $(DIR)
-
-.PHONY: deps
-deps:
-	go get ${u} -d
-	go mod tidy
-
-.PHONY: generate-test-modules
-generate-test-modules: $(TEST_MODULES)
-
-# Compile WASM modules for unit and integration tests
-%.wasm:%.go
-	@if !(type "tinygo" > /dev/null 2>&1); then \
-		echo "Need to install TinyGo. Follow https://tinygo.org/getting-started/install/"; \
-		exit 1; \
-	fi
-	go generate $<
-
-# Run unit tests
-.PHONY: test
-test: $(TEST_MODULES)
-	go test -v -short -coverprofile=coverage.txt -covermode=atomic ./...
-
-integration/testdata/fixtures/images/*.tar.gz: $(GOBIN)/crane
-	mkdir -p integration/testdata/fixtures/images/
-	integration/scripts/download-images.sh
-
-# Run integration tests
-.PHONY: test-integration
-test-integration: integration/testdata/fixtures/images/*.tar.gz
-	go test -v -tags=integration ./integration/... ./pkg/fanal/test/integration/...
-
-# Run WASM integration tests
-.PHONY: test-module-integration
-test-module-integration: integration/testdata/fixtures/images/*.tar.gz $(EXAMPLE_MODULES)
-	go test -v -tags=module_integration ./integration/...
-
-# Run VM integration tests
-.PHONY: test-vm-integration
-test-vm-integration: integration/testdata/fixtures/vm-images/*.img.gz
-	go test -v -tags=vm_integration ./integration/...
-
-integration/testdata/fixtures/vm-images/*.img.gz:
-	integration/scripts/download-vm-images.sh
-
-
-.PHONY: lint
-lint: $(GOBIN)/golangci-lint
-	$(GOBIN)/golangci-lint run --timeout 5m
-
-.PHONY: fmt
-fmt:
-	find ./ -name "*.proto" | xargs clang-format -i
-
-.PHONY: build
-build:
-	go build $(LDFLAGS) ./cmd/trivy
-
-.PHONY: protoc
-protoc:
-	docker build -t trivy-protoc - < Dockerfile.protoc
-	docker run --rm -it -v ${PWD}:/app -w /app trivy-protoc make _$@
-
-_protoc:
-	for path in `find ./rpc/ -name "*.proto" -type f`; do \
-		protoc --twirp_out=. --twirp_opt=paths=source_relative --go_out=. --go_opt=paths=source_relative $${path} || exit; \
-	done
-
-.PHONY: install
-install:
-	go install $(LDFLAGS) ./cmd/trivy
-
-.PHONY: clean
-clean:
-	rm -rf integration/testdata/fixtures/images
-
-# Create labels on GitHub
-.PHONY: label
-label: $(GOBIN)/labeler
-	labeler apply misc/triage/labels.yaml -r aquasecurity/trivy -l 5
-
-# Run MkDocs development server to preview the documentation page
-.PHONY: mkdocs-serve
-mkdocs-serve:
-	docker build -t $(MKDOCS_IMAGE) -f docs/build/Dockerfile docs/build
-	docker run --name mkdocs-serve --rm -v $(PWD):/docs -p $(MKDOCS_PORT):8000 $(MKDOCS_IMAGE)
-
-# Generate JSON marshaler/unmarshaler for TinyGo/WebAssembly as TinyGo doesn't support encoding/json.
-.PHONY: easyjson
-easyjson: $(GOBIN)/easyjson
-	easyjson pkg/module/serialize/types.go

README.md

@@ -31,6 +31,8 @@ Scanners (what Trivy can find there):
 - Sensitive information and secrets
 - Software licenses
 
+Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the [Scanning Coverage] page.
+
 To learn more, go to the [Trivy homepage][homepage] for feature highlights, or to the [Documentation site][docs] for detailed information.
 
 ## Quick Start
@@ -51,6 +53,11 @@ Trivy is integrated with many popular platforms and applications. The complete l
 - [VS Code plugin](https://github.com/aquasecurity/trivy-vscode-extension)
 - See [Ecosystem] for more
 
+### Canary builds
+There are canary builds ([Docker Hub](https://hub.docker.com/r/aquasec/trivy/tags?page=1&name=canary), [GitHub](https://github.com/aquasecurity/trivy/pkgs/container/trivy/75776514?tag=canary), [ECR](https://gallery.ecr.aws/aquasecurity/trivy#canary) images and [binaries](https://github.com/aquasecurity/trivy/actions/workflows/canary.yaml)) as generated every push to main branch.
+
+Please be aware: canary builds might have critical bugs, it's not recommended for use in production.
+
 ### General usage
 
 ```bash
@@ -98,11 +105,21 @@ trivy k8s --report summary cluster
 
 `tri` is pronounced like **tri**gger, `vy` is pronounced like en**vy**.
 
----
+## Want more? Check out Aqua
+
+If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering.  
+You can find a high level comparison table specific to Trivy users [here](https://github.com/aquasecurity/resources/blob/main/trivy-aqua.md).  
+In addition check out the <https://aquasec.com> website for more information about our products and services.
+If you'd like to contact Aqua or request a demo, please use this form: <https://www.aquasec.com/demo>
+
+## Community
 
 Trivy is an [Aqua Security][aquasec] open source project.  
 Learn about our open source work and portfolio [here][oss].  
 Contact us about any matter by opening a GitHub Discussion [here][discussions]
+Join our [Slack community][slack] to stay up to date with community efforts.
+
+Please ensure to abide by our [Code of Conduct][code-of-conduct] during all interactions.
 
 [test]: https://github.com/aquasecurity/trivy/actions/workflows/test.yaml
 [test-img]: https://github.com/aquasecurity/trivy/actions/workflows/test.yaml/badge.svg
@@ -117,9 +134,12 @@ Contact us about any matter by opening a GitHub Discussion [here][discussions]
 [homepage]: https://trivy.dev
 [docs]: https://aquasecurity.github.io/trivy
 [pronunciation]: #how-to-pronounce-the-name-trivy
+[slack]: https://slack.aquasec.com
+[code-of-conduct]: https://github.com/aquasecurity/community/blob/main/CODE_OF_CONDUCT.md
 
 [Installation]:https://aquasecurity.github.io/trivy/latest/getting-started/installation/
 [Ecosystem]: https://aquasecurity.github.io/trivy/latest/ecosystem/
+[Scanning Coverage]: https://aquasecurity.github.io/trivy/latest/docs/coverage/
 
 [alpine]: https://ariadne.space/2021/06/08/the-vulnerability-remediation-lifecycle-of-alpine-containers/
 [rego]: https://www.openpolicyagent.org/docs/latest/#rego

SECURITY.md

@@ -0,0 +1,10 @@
+# Security Policy
+
+## Supported Versions
+
+This is an open source project that is provided as-is without warrenty or liability.  
+As such no supportability commitment. The maintainers will do the best they can to address any report promptly and responsibly.
+
+## Reporting a Vulnerability
+
+Please use the "Private vulnerability reporting" feature in the GitHub repository (under the "Security" tab). 

aqua.yaml

@@ -3,6 +3,8 @@
 # https://aquaproj.github.io/
 registries:
 - type: standard
-  ref: v3.106.0 # renovate: depName=aquaproj/aqua-registry
+  ref: v3.157.0 # renovate: depName=aquaproj/aqua-registry
 packages:
-- name: tinygo-org/tinygo@v0.26.0
+- name: tinygo-org/tinygo@v0.29.0
+- name: WebAssembly/binaryen@version_112
+- name: magefile/mage@v1.14.0

ci/deploy-deb.sh

@@ -14,8 +14,8 @@ done
 
 for release in ${DEBIAN_RELEASES[@]} ${UBUNTU_RELEASES[@]}; do
   echo "Adding deb package to $release"
-  reprepro includedeb $release ../../dist/*Linux-64bit.deb
   reprepro includedeb $release ../../dist/*Linux-32bit.deb
+  reprepro includedeb $release ../../dist/*Linux-64bit.deb
   reprepro includedeb $release ../../dist/*Linux-ARM64.deb
 done
 

ci/deploy-rpm.sh

@@ -2,6 +2,25 @@
 
 TRIVY_VERSION=$(find dist/ -type f -name "*64bit.rpm" -printf "%f\n" | head -n1 | sed -nre 's/^[^0-9]*(([0-9]+\.)*[0-9]+).*/\1/p')
 
+function create_common_rpm_repo () {
+        rpm_path=$1
+
+        ARCHES=("x86_64" "aarch64")
+        for arch in ${ARCHES[@]}; do
+                prefix=$arch
+                if [ "$arch" == "x86_64" ]; then
+                        prefix="64bit"
+                elif [ "$arch" == "aarch64" ]; then
+                        prefix="ARM64"
+                fi
+
+                mkdir -p $rpm_path/$arch
+                cp ../dist/*${prefix}.rpm ${rpm_path}/$arch/
+                createrepo_c -u https://github.com/aquasecurity/trivy/releases/download/ --location-prefix="v"$TRIVY_VERSION --update $rpm_path/$arch
+                rm ${rpm_path}/$arch/*${prefix}.rpm
+        done
+}
+
 function create_rpm_repo () {
         version=$1
         rpm_path=rpm/releases/${version}/x86_64
@@ -18,6 +37,9 @@ echo "Create RPM releases for Trivy v$TRIVY_VERSION"
 
 cd trivy-repo
 
+echo "Processing common repository for RHEL/CentOS..."
+create_common_rpm_repo rpm/releases
+
 VERSIONS=(5 6 7 8 9)
 for version in ${VERSIONS[@]}; do
         echo "Processing RHEL/CentOS $version..."

cmd/trivy/main.go

@@ -9,10 +9,8 @@ import (
 	"github.com/aquasecurity/trivy/pkg/commands"
 	"github.com/aquasecurity/trivy/pkg/log"
 	"github.com/aquasecurity/trivy/pkg/plugin"
-)
 
-var (
-	version = "dev"
+	_ "modernc.org/sqlite" // sqlite driver for RPM DB and Java DB
 )
 
 func main() {
@@ -33,7 +31,7 @@ func run() error {
 		return nil
 	}
 
-	app := commands.NewApp(version)
+	app := commands.NewApp()
 	if err := app.Execute(); err != nil {
 		return err
 	}

contrib/asff.tpl

@@ -91,7 +91,7 @@
             "Severity": {
                 "Label": "{{ $severity }}"
             },
-            "Title": "Trivy found a misconfiguration in {{ $target }}: {{ .Title }}",
+            "Title": "Trivy found a misconfiguration in {{ $target }}: {{ escapeString .Title }}",
             "Description": {{ escapeString $description | printf "%q" }},
             "Remediation": {
                 "Recommendation": {

contrib/html.tpl

@@ -85,7 +85,7 @@
     <h1>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }}</h1>
     <table>
     {{- range . }}
-      <tr class="group-header"><th colspan="6">{{ escapeXML .Type }}</th></tr>
+      <tr class="group-header"><th colspan="6">{{ .Type | toString | escapeXML }}</th></tr>
       {{- if (eq (len .Vulnerabilities) 0) }}
       <tr><th colspan="6">No Vulnerabilities found</th></tr>
       {{- else }}
@@ -128,7 +128,7 @@
         <td>{{ escapeXML .ID }}</td>
         <td class="misconf-check">{{ escapeXML .Title }}</td>
         <td class="severity">{{ escapeXML .Severity }}</td>
-        <td class="link" data-more-links="off"  style="white-space:normal;"">
+        <td class="link" data-more-links="off"  style="white-space:normal;">
           {{ escapeXML .Message }}
           <br>
             <a href={{ escapeXML .PrimaryURL | printf "%q" }}>{{ escapeXML .PrimaryURL }}</a>

contrib/install.sh

@@ -75,10 +75,12 @@ get_binaries() {
     linux/ppc64le) BINARIES="trivy" ;;
     linux/arm64) BINARIES="trivy" ;;
     linux/armv7) BINARIES="trivy" ;;
+    linux/s390x) BINARIES="trivy" ;;
     openbsd/386) BINARIES="trivy" ;;
     openbsd/amd64) BINARIES="trivy" ;;
     openbsd/arm64) BINARIES="trivy" ;;
     openbsd/armv7) BINARIES="trivy" ;;
+    windows/amd64) BINARIES="trivy" ;;
     *)
       log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
       exit 1
@@ -102,6 +104,9 @@ tag_to_version() {
 }
 adjust_format() {
   # change format (tar.gz or zip) based on OS
+  case ${OS} in
+    windows) FORMAT=zip ;;
+  esac
   true
 }
 adjust_os() {
@@ -111,7 +116,8 @@ adjust_os() {
     amd64) OS=64bit ;;
     arm) OS=ARM ;;
     arm64) OS=ARM64 ;;
-    ppc64le) OS=PPC64LE ;;
+    ppc64le) OS=Linux ;;
+    s390x) OS=Linux ;;
     darwin) OS=macOS ;;
     dragonfly) OS=DragonFlyBSD ;;
     freebsd) OS=FreeBSD ;;
@@ -127,8 +133,10 @@ adjust_arch() {
     386) ARCH=32bit ;;
     amd64) ARCH=64bit ;;
     arm) ARCH=ARM ;;
+    armv7) ARCH=ARM ;;
     arm64) ARCH=ARM64 ;;
-    ppc64le) OS=PPC64LE ;;
+    ppc64le) ARCH=PPC64LE ;;
+    s390x) ARCH=s390x ;;
     darwin) ARCH=macOS ;;
     dragonfly) ARCH=DragonFlyBSD ;;
     freebsd) ARCH=FreeBSD ;;
@@ -217,6 +225,7 @@ uname_arch() {
     armv5*) arch="armv5" ;;
     armv6*) arch="armv6" ;;
     armv7*) arch="armv7" ;;
+    s390*) arch="s390x" ;;
   esac
   echo ${arch}
 }

docs/community/contribute/discussion.md

@@ -0,0 +1,49 @@
+# Discussions
+Thank you for taking interest in contributing to Trivy!
+
+Trivy uses [GitHub Discussion](https://github.com/aquasecurity/trivy/discussions) for bug reports, feature requests, and questions.
+If maintainers decide to accept a new feature or confirm that it is a bug, they will close the discussion and create a [GitHub Issue](https://github.com/aquasecurity/trivy/issues) associated with that discussion.
+
+- Feel free to open discussions for any reason. When you open a new discussion, you'll have to select a discussion category as described below.
+- Please spend a small amount of time giving due diligence to the issue/discussion tracker. Your discussion might be a duplicate. If it is, please add your comment to the existing issue/discussion.
+- Remember that users might search for your issue/discussion in the future, so please give it a meaningful title to help others.
+- The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information.
+
+There are 4 categories:
+
+- 💡 [Ideas](https://github.com/aquasecurity/trivy/discussions/categories/ideas)
+    - Share ideas for new features
+- 🔎 [False Detection](https://github.com/aquasecurity/trivy/discussions/categories/false-detection)
+    - Report false positives/negatives
+- 🐛 [Bugs](https://github.com/aquasecurity/trivy/discussions/categories/bugs)
+    - Report something that is not working as expected
+- 🙏 [Q&A](https://github.com/aquasecurity/trivy/discussions/categories/q-a)
+    - Ask the community for help
+
+!!! note
+    If you find any false positives or false negatives, please make sure to report them under the "False Detection" category, not "Bugs".
+
+## False detection
+Trivy depends on [multiple data sources](https://aquasecurity.github.io/trivy/latest/docs/vulnerability/detection/data-source/).
+Sometime these databases contain mistakes.
+
+If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps:
+
+1. Run Trivy with `-f json` that shows data sources.
+2. According to the shown data source, make sure that the security advisory in the data source is correct.
+
+If the data source is correct and Trivy shows wrong results, please raise an issue on Trivy.
+
+### GitHub Advisory Database
+Visit [here](https://github.com/advisories) and search CVE-ID.
+
+If you find a problem, it'll be nice to fix it: [How to contribute to a GitHub security advisory](https://github.blog/2022-02-22-github-advisory-database-now-open-to-community-contributions/)
+ 
+### GitLab Advisory Database
+Visit [here](https://advisories.gitlab.com/) and search CVE-ID.
+
+If you find a problem, it'll be nice to fix it: [Create an issue to GitLab Advisory Database](https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/issues/new)
+ 
+### Red Hat CVE Database
+Visit [here](https://access.redhat.com/security/security-updates/?cwe=476#/cve) and search CVE-ID.
+

docs/community/contribute/issue.md

@@ -1,31 +1,7 @@
+# Issues
 Thank you for taking interest in contributing to Trivy!
 
-- Feel free to open issues for any reason. When you open a new issue, you'll have to select an issue kind: bug/feature/support and fill the required information based on the selected template.
-- Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate. If it is, please add your comment to the existing issue.
-- Remember that users might search for your issue in the future, so please give it a meaningful title to help others.
-- The issue should clearly explain the reason for opening, the proposal if you have any, and any relevant technical information.
-
-## Wrong detection
-Trivy depends on [multiple data sources](https://aquasecurity.github.io/trivy/latest/docs/vulnerability/detection/data-source/).
-Sometime these databases contain mistakes.
-
-If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps:
-
-1. Run Trivy with `-f json` that shows data sources.
-2. According to the shown data source, make sure that the security advisory in the data source is correct.
-
-If the data source is correct and Trivy shows wrong results, please raise an issue on Trivy.
-
-### GitHub Advisory Database
-Visit [here](https://github.com/advisories) and search CVE-ID.
-
-If you find a problem, it'll be nice to fix it: [How to contribute to a GitHub security advisory](https://github.blog/2022-02-22-github-advisory-database-now-open-to-community-contributions/)
- 
-### GitLab Advisory Database
-Visit [here](https://advisories.gitlab.com/) and search CVE-ID.
-
-If you find a problem, it'll be nice to fix it: [Create an issue to GitLab Advisory Database](https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/issues/new)
- 
-### Red Hat CVE Database
-Visit [here](https://access.redhat.com/security/security-updates/?cwe=476#/cve) and search CVE-ID.
+Trivy uses [GitHub Discussion](./discussion.md) for bug reports, feature requests, and questions.
 
+!!! warning
+    Issues created by non-maintainers will be immediately closed.

docs/community/contribute/pr.md

@@ -9,11 +9,71 @@ Thank you for taking interest in contributing to Trivy!
 1. Your PR is more likely to be accepted if it includes tests (We have not historically been very strict about tests, but we would like to improve this!).
 1. If your PR affects the user experience in some way, please update the README.md and the CLI help accordingly.
 
-### Title
+## Development
+Install the necessary tools for development by following their respective installation instructions.
+
+- [Go](https://go.dev/doc/install)
+- [Mage](https://magefile.org/)
+
+### Build
+After making changes to the Go source code, build the project with the following command:
+
+```shell
+$ mage build
+$ ./trivy -h
+```
+
+### Lint
+You must pass the linter checks:
+
+```shell
+$ mage lint:run
+```
+
+Additionally, you need to have run `go mod tidy`, so execute the following command as well:
+
+```shell
+$ mage tidy
+```
+
+To autofix linters use the following command:
+```shell
+$ mage lint:fix
+```
+
+### Unit tests
+Your PR must pass all the unit tests. You can test it as below.
+
+```
+$ mage test:unit
+```
+
+### Integration tests
+Your PR must pass all the integration tests. You can test it as below.
+
+```
+$ mage test:integration
+```
+
+### Documentation
+If you update CLI flags, you need to generate the CLI references.
+The test will fail if they are not up-to-date.
+
+```shell
+$ mage docs:generate
+```
+
+You can build the documents as below and view it at http://localhost:8000.
+
+```
+$ mage docs:serve
+```
+
+## Title
 It is not that strict, but we use the title conventions in this repository.
 Each commit message doesn't have to follow the conventions as long as it is clear and descriptive since it will be squashed and merged.
 
-#### Format of the title
+### Format of the title
 
 ```
 <type>(<scope>): <subject>
@@ -122,7 +182,7 @@ others:
 
 The `<scope>` can be empty (e.g. if the change is a global or difficult to assign to a single component), in which case the parentheses are omitted.
 
-#### Example titles
+### Example titles
 
 ```
 feat(alma): add support for AlmaLinux
@@ -143,33 +203,15 @@ chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0
 **NOTE**: please do not use `chore(deps): update fanal` and something like that if you add new features or fix bugs in Trivy-related projects.
 The PR title should describe what the PR adds or fixes even though it just updates the dependency in Trivy.
 
-### Unit tests
-Your PR must pass all the unit tests. You can test it as below.
+## Commits
 
-```
-$ make test
-```
-
-### Integration tests
-Your PR must pass all the integration tests. You can test it as below.
-
-```
-$ make test-integration
-```
-
-### Documentation
-You can build the documents as below and view it at http://localhost:8000.
-
-```
-$ make mkdocs-serve
-```
 
 ## Understand where your pull request belongs
 
 Trivy is composed of several repositories that work together:
 
 - [Trivy](https://github.com/aquasecurity/trivy) is the client-side, user-facing, command line tool.
-- [vuln-list](https://github.com/aquasecurity/vuln-list) is a vulnerabilities database, aggregated from different sources, and normalized for easy consumption. Think of this as the "server" side of the trivy command line tool. **There should be no pull requests to this repo**
+- [vuln-list](https://github.com/aquasecurity/vuln-list) is a vulnerability database, aggregated from different sources, and normalized for easy consumption. Think of this as the "server" side of the trivy command line tool. **There should be no pull requests to this repo**
 - [vuln-list-update](https://github.com/aquasecurity/vuln-list-update) is the code that maintains the vuln-list database.
 - [trivy-db](https://github.com/aquasecurity/trivy-db) maintains the vulnerability database pulled by Trivy CLI.
 - [go-dep-parser](https://github.com/aquasecurity/go-dep-parser) is a library for parsing lock files such as package-lock.json and Gemfile.lock.

docs/docs/advanced/air-gap.md

@@ -52,7 +52,7 @@ Java users also need to download the Java index database for use in air-gapped e
 === "oras >= v0.13.0"
     Please follow [oras installation instruction][oras].
 
-    Download `db.tar.gz`:
+    Download `javadb.tar.gz`:
 
     ```
     $ oras pull ghcr.io/aquasecurity/trivy-java-db:1
@@ -61,7 +61,7 @@ Java users also need to download the Java index database for use in air-gapped e
 === "oras < v0.13.0"
     Please follow [oras installation instruction][oras].
 
-    Download `db.tar.gz`:
+    Download `javadb.tar.gz`:
 
     ```
     $ oras pull -a ghcr.io/aquasecurity/trivy-java-db:1
@@ -122,7 +122,7 @@ In an air-gapped environment, you have to specify `--skip-db-update` and `--skip
 In addition, if you want to scan `pom.xml` dependencies, you need to specify `--offline-scan` since Trivy tries to issue API requests for scanning Java applications by default.
 
 ```
-$ trivy image --skip-update --skip-java-db-update --offline-scan alpine:3.12
+$ trivy image --skip-db-update --skip-java-db-update --offline-scan alpine:3.12
 ```
 
 ## Air-Gapped Environment for misconfigurations
@@ -139,4 +139,4 @@ $ trivy conf --skip-policy-update /path/to/conf
 [allowlist]: ../references/troubleshooting.md
 [oras]: https://oras.land/cli/
 
-[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../vulnerability/languages/java.md)
+[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../coverage/language/java.md)

docs/docs/advanced/plugins.md

@@ -42,6 +42,11 @@ For example, to download the Kubernetes Trivy plugin you can execute the followi
 ```bash
 $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl
 ```
+Also, Trivy plugin can be installed from a local archive:
+```bash
+$ trivy plugin install myplugin.tar.gz
+```
+
 ## Using Plugins
 Once the plugin is installed, Trivy will load all available plugins in the cache on the start of the next Trivy execution.
 A plugin will be made in the Trivy CLI based on the plugin name.
@@ -162,6 +167,21 @@ When the plugin is called via Trivy CLI, `bin` command will be executed.
 
 The plugin is responsible for handling flags and arguments. Any arguments are passed to the plugin from the `trivy` command.
 
+A plugin should be archived `*.tar.gz`.
+
+```bash
+$ tar -czvf myplugin.tar.gz plugin.yaml script.py
+plugin.yaml
+script.py
+
+$ trivy plugin install myplugin.tar.gz
+2023-03-03T19:04:42.026+0600	INFO	Installing the plugin from myplugin.tar.gz...
+2023-03-03T19:04:42.026+0600	INFO	Loading the plugin metadata...
+
+$ trivy myplugin
+Hello from Trivy demo plugin!
+```
+
 ## Example
 https://github.com/aquasecurity/trivy-plugin-kubectl
 

docs/docs/advanced/private-registries/acr.md

@@ -12,16 +12,16 @@ export SP_DATA=$(az ad sp create-for-rbac --name TrivyTest --role AcrPull --scop
 # Usage
 ```bash
 # must set TRIVY_USERNAME empty char
-export AZURE_CLIENT_ID$(echo $SP_DATA | jq -r .appId)
-export AZURE_CLIENT_SECRET$(echo $SP_DATA | jq -r .password)
-export AZURE_TENANT_ID$(echo $SP_DATA | jq -r .tenant)
+export AZURE_CLIENT_ID=$(echo $SP_DATA | jq -r '.appId')
+export AZURE_CLIENT_SECRET=$(echo $SP_DATA | jq -r '.password')
+export AZURE_TENANT_ID=$(echo $SP_DATA | jq -r '.tenant')
 ```
 
 # Testing
 You can test credentials in the following manner.
 
 ```bash
-docker run -it --rm -v /tmp:/tmp\
-  -e AZURE_CLIENT_ID=${AZURE_CLIENT_ID} -e AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET} \
-  -e AZURE_TENANT_ID=${AZURE_TENANT_ID} aquasec/trivy image your_special_project.azurecr.io/your_special_image:your_special_tag
+docker run -it --rm -v /tmp:/tmp \
+  -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e AZURE_TENANT_ID \
+  aquasec/trivy image your_special_project.azurecr.io/your_special_image:your_special_tag
 ```

docs/docs/advanced/private-registries/docker-hub.md

@@ -1,7 +1,2 @@
-Docker Hub needs `TRIVY_USERNAME` and `TRIVY_PASSWORD`.
-You don't need to set ENV vars when download from public repository.
-
-```bash
-export TRIVY_USERNAME={DOCKERHUB_USERNAME}
-export TRIVY_PASSWORD={DOCKERHUB_PASSWORD}
-```
+See [here](./index.md) for the detail.
+You don't need to provide a credential when download from public repository.

docs/docs/advanced/private-registries/index.md

@@ -1,4 +1,49 @@
-Trivy can download images from a private registry, without installing `Docker` or any other 3rd party tools.
-That's because it's easy to run in a CI process.
+Trivy can download images from a private registry without the need for installing Docker or any other 3rd party tools.
+This makes it easy to run within a CI process.
 
-All you have to do is install `Trivy` and set ENV vars.
+## Credential
+To use Trivy with private images, simply install it and provide your credentials:
+
+```shell
+$ TRIVY_USERNAME=YOUR_USERNAME TRIVY_PASSWORD=YOUR_PASSWORD trivy image YOUR_PRIVATE_IMAGE
+```
+
+Trivy also supports providing credentials through CLI flags:
+
+```shell
+$ TRIVY_PASSWORD=YOUR_PASSWORD trivy image --username YOUR_USERNAME YOUR_PRIVATE_IMAGE
+```
+
+!!! warning
+    The CLI flag `--password` is available, but its use is not recommended for security reasons.
+
+You can also store your credentials in `trivy.yaml`.
+For more information, please refer to [the documentation](../../references/configuration/config-file.md).
+
+It can handle multiple sets of credentials as well:
+
+```shell
+$ export TRIVY_USERNAME=USERNAME1,USERNAME2
+$ export TRIVY_PASSWORD=PASSWORD1,PASSWORD2
+$ trivy image YOUR_PRIVATE_IMAGE
+```
+
+In the example above, Trivy attempts to use two pairs of credentials:
+
+- USERNAME1/PASSWORD1
+- USERNAME2/PASSWORD2
+
+Please note that the number of usernames and passwords must be the same.
+
+## docker login
+If you have Docker configured locally and have set up the credentials, Trivy can access them.
+
+```shell
+$ docker login ghcr.io
+Username: 
+Password:
+$ trivy image ghcr.io/your/private_image
+```
+
+!!! note
+    `docker login` can be used with any container runtime, such as Podman.

docs/docs/configuration/cache.md

@@ -1,4 +1,12 @@
 # Cache
+The cache directory includes 
+
+- [Vulnerability Database][trivy-db][^1]
+- [Java Index Database][trivy-java-db][^2]
+- [Misconfiguration Policies][misconf-policies][^3]
+- Cache of previous scans.
+ 
+The cache option is common to all scanners.
 
 ## Clear Caches
 The `--clear-cache` option removes caches.
@@ -44,7 +52,14 @@ Two options:
 $ trivy server --cache-backend redis://localhost:6379
 ```
 
-Trivy also support for connecting to Redis using TLS, you only need to specify `--redis-ca` , `--redis-cert` , and `--redis-key` option.
+If you want to use TLS with Redis, you can enable it by specifying the `--redis-tls` flag.
+
+```shell
+$ trivy server --cache-backend redis://localhost:6379 --redis-tls
+```
+
+Trivy also supports for connecting to Redis with your certificates.
+You need to specify `--redis-ca` , `--redis-cert` , and `--redis-key` options.
 
 ```
 $ trivy server --cache-backend redis://localhost:6379 \
@@ -53,4 +68,10 @@ $ trivy server --cache-backend redis://localhost:6379 \
   --redis-key /path/to/key.pem
 ```
 
-TLS option for redis is hidden from Trivy command-line flag, but you still can use it.
+[trivy-db]: ./db.md#vulnerability-database
+[trivy-java-db]: ./db.md#java-index-database
+[misconf-policies]: ../scanner/misconfiguration/policy/builtin.md
+
+[^1]: Downloaded when scanning for vulnerabilities
+[^2]: Downloaded when scanning `jar/war/par/ear` files
+[^3]: Downloaded when scanning for misconfigurations

docs/docs/configuration/db.md

@@ -1,9 +1,19 @@
-# Vulnerability DB
+# DB
 
-## Skip update of vulnerability DB
-`Trivy` downloads its vulnerability database every 12 hours when it starts operating.
-This is usually fast, as the size of the DB is only 10~30MB.
-But if you want to skip even that, use the `--skip-db-update` option.
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |           |
+|      Secret      |           |
+|     License      |           |
+
+The vulnerability database and the Java index database are needed only for vulnerability scanning.
+See [here](../scanner/vulnerability.md) for the detail.
+
+## Vulnerability Database
+
+### Skip update of vulnerability DB
+If you want to skip downloading the vulnerability database, use the `--skip-db-update` option.
 
 ```
 $ trivy image --skip-db-update python:3.4-alpine3.9
@@ -29,7 +39,7 @@ Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
 
 </details>
 
-## Only download vulnerability database
+### Only download vulnerability database
 You can also ask `Trivy` to simply retrieve the vulnerability database.
 This is useful to initialize workers in Continuous Integration systems.
 
@@ -37,9 +47,29 @@ This is useful to initialize workers in Continuous Integration systems.
 $ trivy image --download-db-only
 ```
 
-## DB Repository
+### DB Repository
 `Trivy` could also download the vulnerability database from an external OCI registry by using `--db-repository` option.
 
 ```
 $ trivy image --db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db
 ```
+
+## Java Index Database
+The same options are also available for the Java index DB, which is used for scanning Java applications.
+Skipping an update can be done by using the `--skip-java-db-update` option, while `--download-java-db-only` can be used to only download the Java index DB.
+
+Downloading the Java index DB from an external OCI registry can be done by using the `--java-db-repository` option.
+
+```
+$ trivy image --java-db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-java-db --download-java-db-only
+```
+
+!!! Note
+    In [Client/Server](../references/modes/client-server.md) mode, `Java index DB` is currently only used on the `client` side.
+
+## Remove DBs
+The `--reset` flag removes all caches and databases.
+
+```
+$ trivy image --reset
+```

docs/docs/configuration/filtering.md

@@ -1,55 +1,89 @@
-# Filter Vulnerabilities
+# Filtering
+Trivy provides various methods for filtering the results.
 
-## Hide Unfixed Vulnerabilities
 
-By default, `Trivy` also detects unpatched/unfixed vulnerabilities. This means you can't fix these vulnerabilities even if you update all packages.
-If you would like to ignore them, use the `--ignore-unfixed` option.
+## By Status
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |           |
+|      Secret      |           |
+|     License      |           |
+
+Trivy supports the following vulnerability statuses:
+
+- `unknown`
+- `not_affected`: this package is not affected by this vulnerability on this platform
+- `affected`: this package is affected by this vulnerability on this platform, but there is no patch released yet
+- `fixed`: this vulnerability is fixed on this platform
+- `under_investigation`: it is currently unknown whether or not this vulnerability affects this package on this platform, and it is under investigation
+- `will_not_fix`: this package is affected by this vulnerability on this platform, but there is currently no intention to fix it (this would primarily be for flaws that are of Low or Moderate impact that pose no significant risk to customers)
+- `fix_deferred`: this package is affected by this vulnerability on this platform, and may be fixed in the future
+- `end_of_life`: this package has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed
+
+Note that vulnerabilities with the `unknown`, `not_affected` or `under_investigation` status are not detected.
+These are only defined for comprehensiveness, and you will not have the opportunity to specify these statuses.
+
+Some statuses are supported in limited distributions.
+
+|     OS     | Fixed | Affected | Under Investigation | Will Not Fix | Fix Deferred | End of Life |
+|:----------:|:-----:|:--------:|:-------------------:|:------------:|:------------:|:-----------:|
+|   Debian   |   ✓   |    ✓     |                     |              |      ✓       |      ✓      |
+|    RHEL    |   ✓   |    ✓     |          ✓          |      ✓       |      ✓       |      ✓      |
+| Other OSes |   ✓   |    ✓     |                     |              |              |             |
+
+
+To ignore vulnerabilities with specific statuses, use the `--ignore-status <list_of_statuses>` option.
+
 
 ```bash
-$ trivy image --ignore-unfixed ruby:2.4.0
+$ trivy image --ignore-status affected,fixed ruby:2.4.0
 ```
 
 <details>
 <summary>Result</summary>
 
 ```
-2019-05-16T12:49:52.656+0900    INFO    Updating vulnerability database...
 2019-05-16T12:50:14.786+0900    INFO    Detecting Debian vulnerabilities...
 
 ruby:2.4.0 (debian 8.7)
 =======================
-Total: 4730 (UNKNOWN: 1, LOW: 145, MEDIUM: 3487, HIGH: 1014, CRITICAL: 83)
+Total: 527 (UNKNOWN: 0, LOW: 276, MEDIUM: 83, HIGH: 158, CRITICAL: 10)
 
-+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+
-|           LIBRARY            | VULNERABILITY ID | SEVERITY |     INSTALLED VERSION      |          FIXED VERSION           |                        TITLE                        |
-+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+
-| apt                          | CVE-2019-3462    | CRITICAL | 1.0.9.8.3                  | 1.0.9.8.5                        | Incorrect sanitation of the                         |
-|                              |                  |          |                            |                                  | 302 redirect field in HTTP                          |
-|                              |                  |          |                            |                                  | transport method of...                              |
-+                              +------------------+----------+                            +----------------------------------+-----------------------------------------------------+
-|                              | CVE-2016-1252    | MEDIUM   |                            | 1.0.9.8.4                        | The apt package in Debian                           |
-|                              |                  |          |                            |                                  | jessie before 1.0.9.8.4, in                         |
-|                              |                  |          |                            |                                  | Debian unstable before...                           |
-+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+
-| bash                         | CVE-2019-9924    | HIGH     | 4.3-11                     | 4.3-11+deb8u2                    | bash: BASH_CMD is writable in                       |
-|                              |                  |          |                            |                                  | restricted bash shells                              |
-+                              +------------------+          +                            +----------------------------------+-----------------------------------------------------+
-|                              | CVE-2016-7543    |          |                            | 4.3-11+deb8u1                    | bash: Specially crafted                             |
-|                              |                  |          |                            |                                  | SHELLOPTS+PS4 variables allows                      |
-|                              |                  |          |                            |                                  | command substitution                                |
-+                              +------------------+----------+                            +                                  +-----------------------------------------------------+
-|                              | CVE-2016-0634    | MEDIUM   |                            |                                  | bash: Arbitrary code execution                      |
-|                              |                  |          |                            |                                  | via malicious hostname                              |
-+                              +------------------+----------+                            +----------------------------------+-----------------------------------------------------+
-|                              | CVE-2016-9401    | LOW      |                            | 4.3-11+deb8u2                    | bash: popd controlled free                          |
-+------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+
+┌─────────────────────────────┬──────────────────┬──────────┬──────────────┬────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
+│           Library           │  Vulnerability   │ Severity │    Status    │     Installed Version      │ Fixed Version │                            Title                             │
+├─────────────────────────────┼──────────────────┼──────────┼──────────────┼────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
+│ binutils                    │ CVE-2014-9939    │ CRITICAL │ will_not_fix │ 2.25-5                     │               │ binutils: buffer overflow in ihex.c                          │
+│                             │                  │          │              │                            │               │ https://avd.aquasec.com/nvd/cve-2014-9939                    │
+│                             ├──────────────────┤          │              │                            ├───────────────┼──────────────────────────────────────────────────────────────┤
+│                             │ CVE-2017-6969    │          │              │                            │               │ binutils: Heap-based buffer over-read in readelf when        │
+│                             │                  │          │              │                            │               │ processing corrupt RL78 binaries                             │
+│                             │                  │          │              │                            │               │ https://avd.aquasec.com/nvd/cve-2017-6969                    │
+│                             ├──────────────────┤          │              │                            ├───────────────┼──────────────────────────────────────────────────────────────┤
 ...
 ```
 
 </details>
 
+!!! tip
+    To skip all unfixed vulnerabilities, you can use the `--ignore-unfixed` flag .
+    It is a shorthand of `--ignore-status affected,will_not_fix,fix_deferred,end_of_life`.
+    It displays "fixed" vulnerabilities only.
+
+```bash
+$ trivy image --ignore-unfixed ruby:2.4.0
+```
+
 ## By Severity
 
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
+
 Use `--severity` option.
 
 ```bash
@@ -113,9 +147,74 @@ Total: 1785 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1680, CRITICAL: 105)
 
 </details>
 
-## By Vulnerability IDs
+```bash
+trivy conf --severity HIGH,CRITICAL examples/misconf/mixed
+```
+
+<details>
+<summary>Result</summary>
+
+```shell
+2022-05-16T13:50:42.718+0100	INFO	Detected config files: 3
+
+Dockerfile (dockerfile)
+=======================
+Tests: 17 (SUCCESSES: 16, FAILURES: 1, EXCEPTIONS: 0)
+Failures: 1 (HIGH: 1, CRITICAL: 0)
+
+HIGH: Last USER command in Dockerfile should not be 'root'
+═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
+Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
+
+See https://avd.aquasec.com/misconfig/ds002
+───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+ Dockerfile:3
+───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+   3 [ USER root
+───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+
+
+
+deployment.yaml (kubernetes)
+============================
+Tests: 8 (SUCCESSES: 8, FAILURES: 0, EXCEPTIONS: 0)
+Failures: 0 (HIGH: 0, CRITICAL: 0)
+
+
+main.tf (terraform)
+===================
+Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
+Failures: 1 (HIGH: 0, CRITICAL: 1)
+
+CRITICAL: Classic resources should not be used.
+═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
+AWS Classic resources run in a shared environment with infrastructure owned by other AWS customers. You should run
+resources in a VPC instead.
+
+See https://avd.aquasec.com/misconfig/avd-aws-0081
+───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+ main.tf:2-4
+───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+   2 ┌ resource "aws_db_security_group" "sg" {
+   3 │
+   4 └ }
+───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+```
+</details>
+
+## By Finding IDs
+
+Trivy supports the [.trivyignore](#trivyignore) and [.trivyignore.yaml](#trivyignoreyaml) ignore files.
+
+### .trivyignore
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |           |
 
-Use `.trivyignore`.
 
 ```bash
 $ cat .trivyignore
@@ -128,6 +227,15 @@ CVE-2019-14697 exp:2023-01-01
 # No impact in our settings
 CVE-2019-1543
 
+# Ignore misconfigurations
+AVD-DS-0002
+
+# Ignore secrets
+generic-unwanted-rule
+aws-account-id
+```
+
+```bash
 $ trivy image python:3.4-alpine3.9
 ```
 
@@ -146,7 +254,100 @@ Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
 
 </details>
 
-## By Type
+### .trivyignore.yaml
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
+
+!!! warning "EXPERIMENTAL"
+    This feature might change without preserving backwards compatibility.
+
+When the extension of the specified ignore file is either `.yml` or `.yaml`, Trivy will load the file as YAML.
+For the `.trivyignore.yaml` file, you can set ignored IDs separately for `vulnerabilities`, `misconfigurations`, `secrets`, or `licenses`[^1].
+
+Available fields:
+
+| Field      | Required | Type                | Description                                                                                                |
+|------------|:--------:|---------------------|------------------------------------------------------------------------------------------------------------|
+| id         |    ✓     | string              | The identifier of the vulnerability, misconfiguration, secret, or license[^1].                             |
+| paths      |          | string array        | The list of file paths to be ignored. If `paths` is not set, the ignore finding is applied to all files.   |
+| expired_at |          | date (`yyyy-mm-dd`) | The expiration date of the ignore finding. If `expired_at` is not set, the ignore finding is always valid. |
+| statement  |          | string              | The reason for ignoring the finding. (This field is not used for filtering.)                               |
+
+```bash
+$ cat .trivyignore.yaml
+vulnerabilities:
+  - id: CVE-2022-40897
+    paths:
+      - "usr/local/lib/python3.9/site-packages/setuptools-58.1.0.dist-info/METADATA"
+    statement: Accept the risk
+  - id: CVE-2023-2650
+  - id: CVE-2023-3446
+  - id: CVE-2023-3817
+  - id: CVE-2023-29491
+    expired_at: 2023-09-01
+
+misconfigurations:
+  - id: AVD-DS-0001
+  - id: AVD-DS-0002
+    paths:
+      - "docs/Dockerfile"
+    statement: The image needs root privileges
+
+secrets:
+  - id: aws-access-key-id
+  - id: aws-secret-access-key
+    paths:
+      - "foo/bar/aws.secret"
+
+licenses:
+  - id: GPL-3.0 # License name is used as ID
+    paths:
+      - "usr/share/gcc/python/libstdcxx/v6/__init__.py"
+```
+
+Since this feature is experimental, you must explicitly specify the YAML file path using the `--ignorefile` flag.
+Once this functionality is stable, the YAML file will be loaded automatically.
+
+```bash
+$ trivy image --ignorefile ./.trivyignore.yaml python:3.9.16-alpine3.16
+```
+
+<details>
+<summary>Result</summary>
+
+```bash
+2023-08-31T11:10:27.155+0600	INFO	Vulnerability scanning is enabled
+2023-08-31T11:10:27.155+0600	INFO	Secret scanning is enabled
+2023-08-31T11:10:27.155+0600	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
+2023-08-31T11:10:27.155+0600	INFO	Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
+2023-08-31T11:10:29.164+0600	INFO	Detected OS: alpine
+2023-08-31T11:10:29.164+0600	INFO	Detecting Alpine vulnerabilities...
+2023-08-31T11:10:29.169+0600	INFO	Number of language-specific files: 1
+2023-08-31T11:10:29.170+0600	INFO	Detecting python-pkg vulnerabilities...
+
+python:3.9.16-alpine3.16 (alpine 3.16.5)
+========================================
+Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
+
+
+```
+
+</details>
+
+
+## By Vulnerability Target
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |           |
+|      Secret      |           |
+|     License      |           |
+
 Use `--vuln-type` option.
 
 ```bash
@@ -154,6 +355,7 @@ $ trivy image --vuln-type os ruby:2.4.0
 ```
 
 Available values:
+
 - library
 - os
 
@@ -169,7 +371,8 @@ Available values:
 2019-05-22T19:36:53.406+0200    INFO    Detecting pipenv vulnerabilities...
 
 ruby:2.4.0 (debian 8.7)
-Total: 4751 (UNKNOWN: 1, LOW: 150, MEDIUM: 3504, HIGH: 1013, CRITICAL: 83)
+=======================
+Total: 7 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 3, CRITICAL: 2)
 
 +---------+------------------+----------+-------------------+---------------+----------------------------------+
 | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |              TITLE               |
@@ -180,23 +383,6 @@ Total: 4751 (UNKNOWN: 1, LOW: 150, MEDIUM: 3504, HIGH: 1013, CRITICAL: 83)
 |         | CVE-2018-16839   | HIGH     |                   | 7.61.1-r1     | curl: Integer overflow leading   |
 |         |                  |          |                   |               | to heap-based buffer overflow in |
 |         |                  |          |                   |               | Curl_sasl_create_plain_message() |
-+         +------------------+          +                   +---------------+----------------------------------+
-|         | CVE-2019-3822    |          |                   | 7.61.1-r2     | curl: NTLMv2 type-3 header       |
-|         |                  |          |                   |               | stack buffer overflow            |
-+         +------------------+          +                   +---------------+----------------------------------+
-|         | CVE-2018-16840   |          |                   | 7.61.1-r1     | curl: Use-after-free when        |
-|         |                  |          |                   |               | closing "easy" handle in         |
-|         |                  |          |                   |               | Curl_close()                     |
-+         +------------------+----------+                   +---------------+----------------------------------+
-|         | CVE-2019-3823    | MEDIUM   |                   | 7.61.1-r2     | curl: SMTP end-of-response       |
-|         |                  |          |                   |               | out-of-bounds read               |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2018-16890   |          |                   |               | curl: NTLM type-2 heap           |
-|         |                  |          |                   |               | out-of-bounds buffer read        |
-+         +------------------+          +                   +---------------+----------------------------------+
-|         | CVE-2018-16842   |          |                   | 7.61.1-r1     | curl: Heap-based buffer          |
-|         |                  |          |                   |               | over-read in the curl tool       |
-|         |                  |          |                   |               | warning formatting               |
 +---------+------------------+----------+-------------------+---------------+----------------------------------+
 | git     | CVE-2018-17456   | HIGH     | 2.15.2-r0         | 2.15.3-r0     | git: arbitrary code execution    |
 |         |                  |          |                   |               | via .gitmodules                  |
@@ -208,67 +394,6 @@ Total: 4751 (UNKNOWN: 1, LOW: 150, MEDIUM: 3504, HIGH: 1013, CRITICAL: 83)
 | libssh2 | CVE-2019-3855    | CRITICAL | 1.8.0-r2          | 1.8.1-r0      | libssh2: Integer overflow in     |
 |         |                  |          |                   |               | transport read resulting in      |
 |         |                  |          |                   |               | out of bounds write...           |
-+         +------------------+----------+                   +               +----------------------------------+
-|         | CVE-2019-3861    | MEDIUM   |                   |               | libssh2: Out-of-bounds reads     |
-|         |                  |          |                   |               | with specially crafted SSH       |
-|         |                  |          |                   |               | packets                          |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-3857    |          |                   |               | libssh2: Integer overflow in     |
-|         |                  |          |                   |               | SSH packet processing channel    |
-|         |                  |          |                   |               | resulting in out of...           |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-3856    |          |                   |               | libssh2: Integer overflow in     |
-|         |                  |          |                   |               | keyboard interactive handling    |
-|         |                  |          |                   |               | resulting in out of bounds...    |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-3863    |          |                   |               | libssh2: Integer overflow        |
-|         |                  |          |                   |               | in user authenticate             |
-|         |                  |          |                   |               | keyboard interactive allows      |
-|         |                  |          |                   |               | out-of-bounds writes             |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-3862    |          |                   |               | libssh2: Out-of-bounds memory    |
-|         |                  |          |                   |               | comparison with specially        |
-|         |                  |          |                   |               | crafted message channel          |
-|         |                  |          |                   |               | request                          |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-3860    |          |                   |               | libssh2: Out-of-bounds reads     |
-|         |                  |          |                   |               | with specially crafted SFTP      |
-|         |                  |          |                   |               | packets                          |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-3858    |          |                   |               | libssh2: Zero-byte allocation    |
-|         |                  |          |                   |               | with a specially crafted SFTP    |
-|         |                  |          |                   |               | packed leading to an...          |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-3859    |          |                   |               | libssh2: Unchecked use of        |
-|         |                  |          |                   |               | _libssh2_packet_require and      |
-|         |                  |          |                   |               | _libssh2_packet_requirev         |
-|         |                  |          |                   |               | resulting in out-of-bounds       |
-|         |                  |          |                   |               | read                             |
-+---------+------------------+          +-------------------+---------------+----------------------------------+
-| libxml2 | CVE-2018-14404   |          | 2.9.7-r0          | 2.9.8-r1      | libxml2: NULL pointer            |
-|         |                  |          |                   |               | dereference in                   |
-|         |                  |          |                   |               | xpath.c:xmlXPathCompOpEval()     |
-|         |                  |          |                   |               | can allow attackers to cause     |
-|         |                  |          |                   |               | a...                             |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2018-14567   |          |                   |               | libxml2: Infinite loop when      |
-|         |                  |          |                   |               | --with-lzma is used allows for   |
-|         |                  |          |                   |               | denial of service...             |
-+         +------------------+----------+                   +               +----------------------------------+
-|         | CVE-2018-9251    | LOW      |                   |               | libxml2: infinite loop in        |
-|         |                  |          |                   |               | xz_decomp function in xzlib.c    |
-+---------+------------------+----------+-------------------+---------------+----------------------------------+
-| openssh | CVE-2019-6109    | MEDIUM   | 7.5_p1-r9         | 7.5_p1-r10    | openssh: Missing character       |
-|         |                  |          |                   |               | encoding in progress display     |
-|         |                  |          |                   |               | allows for spoofing of scp...    |
-+         +------------------+          +                   +               +----------------------------------+
-|         | CVE-2019-6111    |          |                   |               | openssh: Improper validation     |
-|         |                  |          |                   |               | of object names allows           |
-|         |                  |          |                   |               | malicious server to overwrite    |
-|         |                  |          |                   |               | files...                         |
-+         +------------------+----------+                   +               +----------------------------------+
-|         | CVE-2018-20685   | LOW      |                   |               | openssh: scp client improper     |
-|         |                  |          |                   |               | directory name validation        |
 +---------+------------------+----------+-------------------+---------------+----------------------------------+
 | sqlite  | CVE-2018-20346   | MEDIUM   | 3.21.0-r1         | 3.25.3-r0     | CVE-2018-20505 CVE-2018-20506    |
 |         |                  |          |                   |               | sqlite: Multiple flaws in        |
@@ -283,13 +408,20 @@ Total: 4751 (UNKNOWN: 1, LOW: 150, MEDIUM: 3504, HIGH: 1013, CRITICAL: 83)
 
 </details>
 
-
 ## By Open Policy Agent
 
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |           |
+|     License      |           |
+
 !!! warning "EXPERIMENTAL"
     This feature might change without preserving backwards compatibility.
 
-Trivy supports Open Policy Agent (OPA) to filter vulnerabilities. You can specify a Rego file with `--ignore-policy` option.
+Trivy supports Open Policy Agent (OPA) to filter vulnerabilities.
+You can specify a Rego file with `--ignore-policy` option.
 
 The Rego package name must be `trivy` and it must include a rule called `ignore` which determines if each individual vulnerability should be excluded (ignore=true) or not (ignore=false). In the policy, each vulnerability will be available for inspection as the `input` variable. The structure of each vulnerability input is the same as for the Trivy JSON output.  
 There is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`. For more info about the helper functions, look at the library [here][helper]
@@ -357,3 +489,30 @@ Total: 9 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 4, CRITICAL: 5)
 
 [helper]: https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go
 [policy]: https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/contrib/example_policy
+
+## By Inline Comments
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |           |
+| Misconfiguration |     ✓     |
+|      Secret      |           |
+|     License      |           |
+
+Some configuration file formats (e.g. Terraform) support inline comments.
+
+In cases where trivy can detect comments of a specific format immediately adjacent to resource definitions, it is possible to filter/ignore findings from a single point of resource definition (in contrast to `.trivyignore`, which has a directory-wide scope on all of the files scanned).
+
+The format for these comments is `trivy:ignore:<Vulnerability ID>` immediately following the format-specific line-comment token.
+
+For example, to filter a Vulnerability ID "AVD-GCP-0051" in a Terraform HCL file:
+
+```terraform
+#trivy:ignore:AVD-GCP-0051
+resource "google_container_cluster" "one_off_test" {
+  name     = var.cluster_name
+  location = var.region
+}
+```
+
+[^1]: license name is used as id for `.trivyignore.yaml` files

docs/docs/configuration/index.md

@@ -0,0 +1,31 @@
+# Configuration
+Trivy can be configured using the following ways. Each item takes precedence over the item below it:
+
+- CLI flags
+- Environment variables
+- Configuration file
+
+## CLI Flags
+You can view the list of available flags using the `--help` option.
+For more details, please refer to [the CLI reference](../references/configuration/cli/trivy.md).
+
+## Environment Variables
+Trivy can be customized by environment variables.
+The environment variable key is the flag name converted by the following procedure.
+
+- Add `TRIVY_` prefix
+- Make it all uppercase
+- Replace `-` with `_`
+
+For example,
+
+- `--debug` => `TRIVY_DEBUG`
+- `--cache-dir` => `TRIVY_CACHE_DIR`
+
+```
+$ TRIVY_DEBUG=true TRIVY_SEVERITY=CRITICAL trivy image alpine:3.15
+```
+
+## Configuration File
+By default, Trivy reads the `trivy.yaml` file.
+For more details, please refer to [the page](../references/configuration/config-file.md).

docs/docs/configuration/others.md

@@ -0,0 +1,119 @@
+# Others
+
+## Enable/Disable Scanners
+You can enable/disable scanners with the `--scanners` flag.
+
+Supported values:
+
+- vuln
+- config
+- secret
+- license
+ 
+For example, container image scanning enables vulnerability and secret scanners by default.
+If you don't need secret scanning, it can be disabled.
+
+``` shell
+$ trivy image --scanners vuln alpine:3.15
+```
+
+## Exit Code
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
+
+By default, `Trivy` exits with code 0 even when security issues are detected.
+Use the `--exit-code` option if you want to exit with a non-zero exit code.
+
+```
+$ trivy image --exit-code 1 python:3.4-alpine3.9
+```
+
+<details>
+<summary>Result</summary>
+
+```
+2019-05-16T12:51:43.500+0900    INFO    Updating vulnerability database...
+2019-05-16T12:52:00.387+0900    INFO    Detecting Alpine vulnerabilities...
+
+python:3.4-alpine3.9 (alpine 3.9.2)
+===================================
+Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)
+
++---------+------------------+----------+-------------------+---------------+--------------------------------+
+| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |             TITLE              |
++---------+------------------+----------+-------------------+---------------+--------------------------------+
+| openssl | CVE-2019-1543    | MEDIUM   | 1.1.1a-r1         | 1.1.1b-r1     | openssl: ChaCha20-Poly1305     |
+|         |                  |          |                   |               | with long nonces               |
++---------+------------------+----------+-------------------+---------------+--------------------------------+
+```
+
+</details>
+
+This option is useful for CI/CD. In the following example, the test will fail only when a critical vulnerability is found.
+
+```
+$ trivy image --exit-code 0 --severity MEDIUM,HIGH ruby:2.4.0
+$ trivy image --exit-code 1 --severity CRITICAL ruby:2.4.0
+```
+
+## Exit on EOL
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |           |
+|      Secret      |           |
+|     License      |           |
+
+Sometimes you may surprisingly get 0 vulnerabilities in an old image:
+
+- Enabling `--ignore-unfixed` option while all packages have no fixed versions.
+- Scanning a rather outdated OS (e.g. Ubuntu 10.04).
+
+An OS at the end of service/life (EOL) usually gets into this situation, which is definitely full of vulnerabilities.
+`--exit-on-eol` can fail scanning on EOL OS with a non-zero code.
+This flag is available with the following targets.
+
+- Container images (`trivy image`)
+- Virtual machine images (`trivy vm`)
+- SBOM (`trivy sbom`)
+- Root filesystem (`trivy rootfs`)
+
+```
+$ trivy image --exit-on-eol 1 alpine:3.10
+```
+
+<details>
+<summary>Result</summary>
+
+```
+2023-03-01T11:07:15.455+0200    INFO    Vulnerability scanning is enabled
+...
+2023-03-01T11:07:17.938+0200    WARN    This OS version is no longer supported by the distribution: alpine 3.10.9
+2023-03-01T11:07:17.938+0200    WARN    The vulnerability detection may be insufficient because security updates are not provided
+
+alpine:3.10 (alpine 3.10.9)
+===========================
+Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 1)
+
+┌───────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
+│  Library  │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                            Title                            │
+├───────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
+│ apk-tools │ CVE-2021-36159 │ CRITICAL │ 2.10.6-r0         │ 2.10.7-r0     │ libfetch before 2021-07-26, as used in apk-tools, xbps, and │
+│           │                │          │                   │               │ other products, mishandles...                               │
+│           │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2021-36159                  │
+└───────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
+2023-03-01T11:07:17.941+0200    ERROR   Detected EOL OS: alpine 3.10.9
+```
+
+</details>
+
+This option is useful for CI/CD.
+The following example will fail when a critical vulnerability is found or the OS is EOSL:
+
+```
+$ trivy image --exit-code 1 --exit-on-eol 1 --severity CRITICAL alpine:3.16.3
+```

docs/docs/configuration/reporting.md

@@ -1,12 +1,36 @@
-# Report Formats
+# Reporting
 
-## Table (Default)
+## Supported Formats
+Trivy supports the following formats:
+
+- Table
+- JSON
+- [SARIF](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning)
+- Template
+- SBOM
+- GitHub dependency snapshot
+
+### Table (Default)
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
 
 ```
 $ trivy image -f table golang:1.12-alpine
 ```
 
-### Show origins of vulnerable dependencies
+#### Show origins of vulnerable dependencies
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |           |
+|      Secret      |           |
+|     License      |           |
 
 !!! warning "EXPERIMENTAL"
     This feature might change without preserving backwards compatibility.
@@ -19,10 +43,28 @@ This flag is only available with the `--format table` flag.
 
 The following packages/languages are currently supported:
 
-- OS packages (apk, dpkg and rpm)
-- Node.js (package-lock.json and yarn.lock) 
-- Nuget lock files (packages.lock.json)
-- Rust Binaries built with [cargo-auditable][cargo-auditable]
+- OS packages 
+    - apk
+    - dpkg
+    - rpm
+- Node.js 
+    - npm: package-lock.json
+    - pnpm: pnpm-lock.yaml
+    - yarn: yarn.lock
+- .NET
+    - NuGet: packages.lock.json
+- Python 
+    - Poetry: poetry.lock
+- Ruby
+    - Bundler: Gemfile.lock
+- Rust
+    - Binaries built with [cargo-auditable][cargo-auditable]
+- Go
+    - Modules: go.mod
+- PHP
+    - Composer
+- Java
+    - Maven: pom.xml
 
 This tree is the reverse of the npm list command.
 However, if you want to resolve a vulnerability in a particular indirect dependency, the reversed tree is useful to know where that dependency comes from and identify which package you actually need to update.
@@ -47,8 +89,8 @@ Total: 2 (HIGH: 1, CRITICAL: 1)
 │                  │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2020-28469                 │
 └──────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘
 
-Dependency Origin Tree
-======================
+Dependency Origin Tree (Reversed)
+=================================
 package-lock.json
 ├── follow-redirects@1.14.6, (HIGH: 1, CRITICAL: 0)
 │   └── axios@0.21.4
@@ -67,15 +109,19 @@ Also, **glob-parent@3.1.0** with some vulnerabilities is included through chain
 
 Then, you can try to update **axios@0.21.4** and **cra-append-sw@2.7.0** to resolve vulnerabilities in **follow-redirects@1.14.6** and **glob-parent@3.1.0**.
 
-## JSON
+### JSON
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
 
 ```
 $ trivy image -f json -o results.json golang:1.12-alpine
 ```
 
-!!! caution
-    v0.20.0 changes the JSON schema. For more details, see [here][new-json].
-
 <details>
 <summary>Result</summary>
 
@@ -197,8 +243,15 @@ $ trivy image -f json -o results.json golang:1.12-alpine
 
 `VulnerabilityID`, `PkgName`, `InstalledVersion`, and `Severity` in `Vulnerabilities` are always filled with values, but other fields might be empty.
 
-## SARIF
-[Sarif][sarif] can be generated with the `--format sarif` option.
+### SARIF
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
+
+[SARIF][sarif] can be generated with the `--format sarif` flag.
 
 ```
 $ trivy image --format sarif -o report.sarif  golang:1.12-alpine
@@ -206,9 +259,30 @@ $ trivy image --format sarif -o report.sarif  golang:1.12-alpine
 
 This SARIF file can be uploaded to GitHub code scanning results, and there is a [Trivy GitHub Action][action] for automating this process.
 
-## Template
+### GitHub dependency snapshot
+Trivy supports the following packages.
 
-### Custom Template
+- [OS packages][os_packages]
+- [Language-specific packages][language_packages]
+
+[GitHub dependency snapshots][github-sbom] can be generated with the `--format github` flag.
+
+```
+$ trivy image --format github -o report.gsbom alpine
+```
+
+This snapshot file can be [submitted][github-sbom-submit] to your GitHub repository.
+
+### Template
+
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
+
+#### Custom Template
 
 {% raw %}
 ```
@@ -245,27 +319,47 @@ Critical: 0, High: 2
 
 For other features of sprig, see the official [sprig][sprig] documentation.
 
-### Load templates from a file
+#### Load templates from a file
 You can load templates from a file prefixing the template path with an @.
 
 ```
 $ trivy image --format template --template "@/path/to/template" golang:1.12-alpine
 ```
 
-### Default Templates
+#### Default Templates
 
 If Trivy is installed using rpm then default templates can be found at `/usr/local/share/trivy/templates`.
 
-#### XML
+##### JUnit
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |           |
+|     License      |           |
+
 In the following example using the template `junit.tpl` XML can be generated.
 ```
 $ trivy image --format template --template "@contrib/junit.tpl" -o junit-report.xml  golang:1.12-alpine
 ```
 
-#### ASFF
+##### ASFF
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |           |
+
 Trivy also supports an [ASFF template for reporting findings to AWS Security Hub][asff]
 
-#### HTML
+##### HTML
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |           |
+|     License      |           |
 
 ```
 $ trivy image --format template --template "@contrib/html.tpl" -o report.html golang:1.12-alpine
@@ -277,9 +371,41 @@ The following example shows use of default HTML template when Trivy is installed
 $ trivy image --format template --template "@/usr/local/share/trivy/templates/html.tpl" -o report.html golang:1.12-alpine
 ```
 
+### SBOM
+See [here](../supply-chain/sbom.md) for details.
+
+## Converting
+To generate multiple reports, you can generate the JSON report first and convert it to other formats with the `convert` subcommand.
+
+```shell
+$ trivy image --format json -o result.json --list-all-pkgs debian:11
+$ trivy convert --format cyclonedx --output result.cdx result.json
+```
+
+!!! note
+    Please note that if you want to convert to a format that requires a list of packages, 
+    such as SBOM, you need to add the `--list-all-pkgs` flag when outputting in JSON.
+
+[Filtering options](./filtering.md) such as `--severity` are also available with `convert`.
+
+```shell
+# Output all severities in JSON
+$ trivy image --format json -o result.json --list-all-pkgs debian:11
+
+# Output only critical issues in table format
+$ trivy convert --format table --severity CRITICAL result.json
+```
+
+!!! note
+    JSON reports from "trivy aws" and "trivy k8s" are not yet supported.
+
 [cargo-auditable]: https://github.com/rust-secure-code/cargo-auditable/
-[new-json]: https://github.com/aquasecurity/trivy/discussions/1050
 [action]: https://github.com/aquasecurity/trivy-action
-[asff]: ../../../tutorials/integrations/aws-security-hub.md
+[asff]: ../../tutorials/integrations/aws-security-hub.md
 [sarif]: https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-results-from-code-scanning
 [sprig]: http://masterminds.github.io/sprig/
+[github-sbom]: https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28#about-dependency-submissions
+[github-sbom-submit]: https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28#create-a-snapshot-of-dependencies-for-a-repository
+
+[os_packages]: ../scanner/vulnerability.md#os-packages
+[language_packages]: ../scanner/vulnerability.md#language-specific-packages

docs/docs/configuration/skipping.md

@@ -0,0 +1,116 @@
+# Skipping Files and Directories
+
+This section details ways to specify the files and directories that Trivy should not scan.
+
+## Skip Files
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
+
+By default, Trivy traverses directories and searches for all necessary files for scanning.
+You can skip files that you don't maintain using the `--skip-files` flag, or the equivalent Trivy YAML config option.
+
+Using the `--skip-files` flag:
+```bash
+$ trivy image --skip-files "/Gemfile.lock" --skip-files "/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0/Gemfile.lock" quay.io/fluentd_elasticsearch/fluentd:v2.9.0
+```
+
+Using the Trivy YAML configuration:
+```yaml
+image:
+  skip-files:
+    - foo
+    - "testdata/*/bar"
+```
+
+It's possible to specify globs as part of the value.
+
+```bash
+$ trivy image --skip-files "./testdata/*/bar" .
+```
+
+This will skip any file named `bar` in the subdirectories of testdata.
+
+```bash
+$ trivy config --skip-files "./foo/**/*.tf" .
+```
+
+This will skip any files with the extension `.tf` in subdirectories of foo at any depth.
+
+## Skip Directories
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+|     License      |     ✓     |
+
+By default, Trivy traverses directories and searches for all necessary files for scanning.
+You can skip directories that you don't maintain using the `--skip-dirs` flag, or the equivalent Trivy YAML config option.
+
+Using the `--skip-dirs` flag:
+```bash
+$ trivy image --skip-dirs /var/lib/gems/2.5.0/gems/fluent-plugin-detect-exceptions-0.0.13 --skip-dirs "/var/lib/gems/2.5.0/gems/http_parser.rb-0.6.0" quay.io/fluentd_elasticsearch/fluentd:v2.9.0
+```
+
+Using the Trivy YAML configuration:
+```yaml
+image:
+  skip-dirs:
+    - foo/bar/
+    - "**/.terraform"
+```
+
+It's possible to specify globs as part of the value.
+
+```bash
+$ trivy image --skip-dirs "./testdata/*" .
+```
+
+This will skip all subdirectories of the testdata directory.
+
+```bash
+$ trivy config --skip-dirs "**/.terraform" .
+```
+
+This will skip subdirectories at any depth named `.terraform/`. (Note: this will match `./foo/.terraform` or
+`./foo/bar/.terraform`, but not `./.terraform`.)
+
+!!! tip
+    Glob patterns work with any trivy subcommand (image, config, etc.) and can be specified to skip both directories (with `--skip-dirs`) and files (with `--skip-files`).
+
+
+### Advanced globbing
+Trivy also supports bash style [extended](https://www.gnu.org/savannah-checkouts/gnu/bash/manual/bash.html#Pattern-Matching) glob pattern matching.
+
+```bash
+$ trivy image --skip-files "**/foo" image:tag
+```
+
+This will skip the file `foo` that happens to be nested under any parent(s). 
+
+## File patterns
+|     Scanner      | Supported |
+|:----------------:|:---------:|
+|  Vulnerability   |     ✓     |
+| Misconfiguration |     ✓     |
+|      Secret      |           |
+|     License      |           |
+
+When a directory is given as an input, Trivy will recursively look for and test all files based on file patterns.
+The default file patterns are [here](../scanner/misconfiguration/custom/index.md).
+
+In addition to the default file patterns, the `--file-patterns` option takes regexp patterns to look for your files.
+For example, it may be useful when your file name of Dockerfile doesn't match the default patterns.
+
+This can be repeated for specifying multiple file patterns.
+
+A file pattern contains the analyzer it is used for, and the pattern itself, joined by a semicolon. For example:
+```
+--file-patterns "dockerfile:.*.docker" --file-patterns "kubernetes:*.tpl" --file-patterns "pip:requirements-.*\.txt"
+```
+
+The prefixes are listed [here](https://github.com/aquasecurity/trivy/tree/{{ git.commit }}/pkg/fanal/analyzer/const.go)

docs/docs/coverage/iac/azure-arm.md

@@ -0,0 +1,33 @@
+# Azure ARM Template
+Trivy supports the scanners listed in the table below.
+
+|      Scanner       | Supported |
+| :----------------: | :-------: |
+| [Misconfiguration] |     ✓     |
+|      [Secret]      |     ✓     |
+
+It supports the following configurations:
+
+|    Format    | Supported |
+| :----------: | :-------: |
+| ARM template |     ✓     |
+|    Bicep     |   ✓[^1]   |
+
+To scan Bicep codes, you need to convert them into ARM templates first.
+
+```
+az bicep build -f main.bicep
+or
+bicep build main.bicep
+```
+
+## Misconfiguration
+Trivy recursively searches directories and scans all found Azure ARM templates.
+
+## Secret
+The secret scan is performed on plain text files, with no special treatment for Azure ARM templates.
+
+[Misconfiguration]: ../../scanner/misconfiguration/index.md
+[Secret]: ../../scanner/secret.md
+
+[^1]: Bicep is not natively supported. It needs to be converted into Azure ARM templates.

docs/docs/coverage/iac/cloudformation.md

@@ -0,0 +1,24 @@
+# CloudFormation
+Trivy supports the scanners listed in the table below.
+
+|      Scanner       | Supported |
+| :----------------: | :-------: |
+| [Misconfiguration] |     ✓     |
+|      [Secret]      |     ✓     |
+
+It supports the following formats.
+
+| Format | Supported |
+| :----: | :-------: |
+|  JSON  |     ✓     |
+|  YAML  |     ✓     |
+
+## Misconfiguration
+Trivy recursively searches directories and scans all found CloudFormation files.
+It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations.
+
+## Secret
+The secret scan is performed on plain text files, with no special treatment for CloudFormation.
+
+[Misconfiguration]: ../../scanner/misconfiguration/index.md
+[Secret]: ../../scanner/secret.md

docs/docs/coverage/iac/docker.md

@@ -0,0 +1,24 @@
+# Docker
+Trivy supports the scanners listed in the table below.
+
+|      Scanner       | Supported |
+| :----------------: | :-------: |
+| [Misconfiguration] |     ✓     |
+|      [Secret]      |     ✓     |
+
+It supports the following configurations.
+
+|    Config     | Supported |
+| :-----------: | :-------: |
+|  Dockerfile   |     ✓     |
+| Containerfile |     ✓     |
+|    Compose    |     -     |
+
+## Misconfiguration
+Trivy recursively searches directories and scans all found Docker files.
+
+## Secret
+The secret scan is performed on plain text files, with no special treatment for Dockerfile.
+
+[Misconfiguration]: ../../scanner/misconfiguration/index.md
+[Secret]: ../../scanner/secret.md

docs/docs/coverage/iac/helm.md

@@ -0,0 +1,60 @@
+# Helm
+Trivy supports two types of Helm scanning, templates and packaged charts.
+The following scanners are supported.
+
+| Format   | [Misconfiguration] | [Secret] |
+| -------- | :----------------: | :------: |
+| Template |         ✓          |    ✓     |
+| Chart    |         ✓          |    -     |
+
+## Misconfiguration
+Trivy recursively searches directories and scans all found Helm files.
+
+It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks.
+See [here](../../scanner/misconfiguration/policy/builtin.md) for more details on the built-in policies.
+
+### Value overrides
+There are a number of options for overriding values in Helm charts.
+When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact.
+
+#### Setting inline value overrides
+Overrides can be set inline on the command line
+
+```bash
+trivy conf --helm-set securityContext.runAsUser=0 ./charts/mySql
+```
+
+#### Setting value file overrides
+Overrides can be in a file that has the key=value set.
+
+```yaml
+# Example override file (overrides.yaml)
+
+securityContext:
+  runAsUser: 0
+```
+
+```bash
+trivy conf --helm-values overrides.yaml ./charts/mySql
+``` 
+
+#### Setting value as explicit string
+the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string
+
+```bash
+trivy config --helm-set-string name=false ./infrastructure/tf
+```
+
+#### Setting specific values from files
+Specific override values can come from specific files
+
+```bash
+trivy conf --helm-set-file environment=dev.values.yaml ./charts/mySql
+```
+
+## Secret
+The secret scan is performed on plain text files, with no special treatment for Helm.
+Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.
+
+[Misconfiguration]: ../../scanner/misconfiguration/index.md
+[Secret]: ../../scanner/secret.md

docs/docs/coverage/iac/index.md

@@ -0,0 +1,21 @@
+# Infrastructure as Code
+
+## Scanner
+Trivy scans Infrastructure as Code (IaC) files for 
+
+- [Misconfigurations][misconf]
+- [Secrets][secret]
+
+## Supported configurations
+
+| Config type                         | File patterns                 |
+| ----------------------------------- | ----------------------------- |
+| [Kubernetes](kubernetes.md)         | *.yml, *.yaml, *.json         |
+| [Docker](docker.md)                 | Dockerfile, Containerfile     |
+| [Terraform](terraform.md)           | *.tf, *.tf.json, *.tfvars,    |
+| [CloudFormation](cloudformation.md) | *.yml, *.yaml, *.json         |
+| [Azure ARM Template](azure-arm.md)  | *.json                        |
+| [Helm](helm.md)                     | *.yaml, *.tpl, *.tar.gz, etc. |
+
+[misconf]: ../../scanner/misconfiguration/index.md
+[secret]: ../../scanner/secret.md

docs/docs/coverage/iac/kubernetes.md

@@ -0,0 +1,31 @@
+# Kubernetes
+Trivy supports the scanners listed in the table below.
+
+|      Scanner       | Supported |
+| :----------------: | :-------: |
+| [Misconfiguration] |     ✓     |
+|      [Secret]      |     ✓     |
+
+In addition to raw YAML and JSON, it supports the following templates:
+
+|    Template     | Supported |
+| :-------------: | :-------: |
+| [Helm](helm.md) |     ✓     |
+|    Kustomize    |   ✓[^1]   |
+
+!!! note
+    Trivy does not support Kustomize overlays, so it scans files defined in the base.
+    Or, you can scan the output of `kustomize build`.
+
+## Misconfiguration
+Trivy recursively searches directories and scans all found Kubernetes files.
+
+## Secret
+The secret scan is performed on plain text files, with no special treatment for Kubernetes.
+This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected.
+
+
+[Misconfiguration]: ../../scanner/misconfiguration/index.md
+[Secret]: ../../scanner/secret.md
+
+[^1]: Kustomize is not natively supported.

docs/docs/coverage/iac/terraform.md

@@ -0,0 +1,45 @@
+# Terraform
+Trivy supports the scanners listed in the table below.
+
+|     Scanner      | Supported |
+| :--------------: | :-------: |
+| Misconfiguration |     ✓     |
+|      Secret      |     ✓     |
+
+It supports the following formats:
+
+|  Format   | Supported |
+| :-------: | :-------: |
+|   JSON    |     ✓     |
+|    HCL    |     ✓     |
+| Plan JSON |     ✓     |
+
+Trivy can scan the results of `terraform plan`.
+You can scan by passing the file generated as shown below to Trivy:
+
+```
+$ terraform plan --out tfplan.binary
+$ terraform show -json tfplan.binary > tfplan.json
+```
+
+## Misconfiguration
+Trivy recursively searches directories and scans all found Terraform files.
+It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations.
+
+### Value Overrides
+You can provide `tf-vars` files to Trivy to override default values specified in the Terraform HCL code.
+
+```bash
+trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf
+```
+
+### Exclude Downloaded Terraform Modules
+By default, downloaded modules are also scanned.
+If you don't want to scan modules downloaded into the `.terraform` directory, you can use the `--tf-exclude-downloaded-modules` flag.
+
+```bash
+trivy conf --tf-exclude-downloaded-modules ./configs
+```
+
+## Secret
+The secret scan is performed on plain text files, with no special treatment for Terraform.

docs/docs/coverage/index.md

@@ -0,0 +1,9 @@
+# Scanning Coverage
+Trivy can detect security issues in many different platforms, languages and configuration files.
+This section gives a general overview of that coverage, and can help answer the frequently asked question "Does Trivy support X?".
+For more detailed information about the specific platforms and languages, check the relevant documentation.
+
+- [OS Packages](os/index.md)
+- [Language-specific Packages](language/index.md)
+- [IaC files](iac/index.md)
+- [Kubernetes clusters](./kubernetes.md)

docs/docs/coverage/kubernetes.md

@@ -0,0 +1,22 @@
+# Kubernetes
+
+When scanning a Kubernetes cluster, Trivy differentiates between the following:
+
+1. Cluster infrastructure (e.g api-server, kubelet, addons)
+1. Cluster configuration (e.g Roles, ClusterRoles). 
+1. Application workloads (e.g nginx, postgresql).
+
+Whenever Trivy scans either of these Kubernetes resources, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource.
+When scanning any of the above, the container image is scanned separately to the Kubernetes resource definition (the YAML manifest) that defines the resource.
+
+Container image is scanned for:
+- Vulnerabilities
+- Misconfigurations
+- Exposed secrets
+
+Kubernetes resource definition is scanned for:
+- Vulnerabilities - partially supported through [KBOM scanning](#KBOM)
+- Misconfigurations
+- Exposed secrets
+
+To learn more, please see the [documentation for Kubernetes scanning](../target/kubernetes.md)

docs/docs/coverage/language/c.md

@@ -0,0 +1,23 @@
+# C/C++
+
+Trivy supports [Conan][conan] C/C++ Package Manager.
+
+The following scanners are supported.
+
+| Package manager | SBOM  | Vulnerability | License |
+| --------------- | :---: | :-----------: | :-----: |
+| Conan           |   ✓   |       ✓       |    -    |
+
+The following table provides an outline of the features Trivy offers.
+
+| Package manager | File           | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+| --------------- | -------------- | :---------------------: | :--------------: | :----------------------------------: | :------: |
+| Conan           | conan.lock[^1] |            ✓            |     Excluded     |                  ✓                   |    ✓     |
+
+## Conan
+In order to detect dependencies, Trivy searches for `conan.lock`[^1].
+
+[conan]: https://docs.conan.io/1/index.html
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[^1]: `conan.lock` is default name. To scan a custom filename use [file-patterns](../../configuration/skipping.md#file-patterns)

docs/docs/coverage/language/dart.md

@@ -0,0 +1,26 @@
+# Dart
+
+Trivy supports [Dart][dart].
+
+The following scanners are supported.
+
+| Package manager         | SBOM  | Vulnerability | License |
+|-------------------------| :---: | :-----------: |:-------:|
+| [Dart][dart-repository] |   ✓   |       ✓       |    -    |
+
+The following table provides an outline of the features Trivy offers.
+
+
+| Package manager         | File         | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|-------------------------|--------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
+| [Dart][dart-repository] | pubspec.lock |            ✓            |     Included     |                  -                   |    -     |
+
+## Dart
+In order to detect dependencies, Trivy searches for `pubspec.lock`.
+
+Trivy marks indirect dependencies, but `pubspec.lock` file doesn't have options to separate root and dev transitive dependencies.
+So Trivy includes all dependencies in report.
+
+[dart]: https://dart.dev/
+[dart-repository]: https://pub.dev/
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/language/dotnet.md

@@ -0,0 +1,47 @@
+# .NET
+
+Trivy supports `.NET core` and `NuGet` package managers.
+
+The following scanners are supported.
+
+| Artifact  | SBOM | Vulnerability | License |
+|-----------|:----:|:-------------:|:-------:|
+| .Net Core |  ✓   |       ✓       |    -    |
+| NuGet     |  ✓   |       ✓       |    ✓    |
+
+The following table provides an outline of the features Trivy offers.
+
+| Package manager | File               | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|:---------------:|--------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
+|    .Net Core    | *.deps.json        |            ✓            |     Excluded     |                  -                   |    ✓     |
+|      NuGet      | packages.config    |            ✓            |     Excluded     |                  -                   |    -     |
+|      NuGet      | packages.lock.json |            ✓            |     Included     |                  ✓                   |    ✓     |
+
+## *.deps.json
+Trivy parses `*.deps.json` files. Trivy currently excludes dev dependencies from the report.
+
+## packages.config
+Trivy only finds dependency names and versions from `packages.config` files. To build dependency graph, it is better to use `packages.lock.json` files.
+
+### license detection
+`packages.config` files don't have information about the licenses used.
+Trivy uses [*.nuspec][nuspec] files from [global packages folder][global-packages] to detect licenses.
+!!! note
+    The `licenseUrl` field is [deprecated][license-url]. Trivy doesn't parse this field and only checks the [license] field (license `expression` type only).
+Currently only the default path and `NUGET_PACKAGES` environment variable are supported.
+
+## packages.lock.json
+Don't forgot to [enable][enable-lock] lock files in your project.
+
+!!! tip
+    Please make sure your lock file is up-to-date after modifying dependencies.
+
+### license detection
+Same as [packages.config](#license-detection)
+
+[enable-lock]: https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#enabling-the-lock-file
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[nuspec]: https://learn.microsoft.com/en-us/nuget/reference/nuspec
+[global-packages]: https://learn.microsoft.com/en-us/nuget/consume-packages/managing-the-global-packages-and-cache-folders
+[license]: https://learn.microsoft.com/en-us/nuget/reference/nuspec#license
+[license-url]: https://learn.microsoft.com/en-us/nuget/reference/nuspec#licenseurl

docs/docs/coverage/language/elixir.md

@@ -0,0 +1,27 @@
+# Elixir
+
+Trivy supports [Hex][hex] repository for [Elixir][elixir].
+
+The following scanners are supported.
+
+| Package manager | SBOM  | Vulnerability | License |
+|-----------------| :---: | :-----------: |:-------:|
+| [hex][hex]        |   ✓   |       ✓       |    -    |
+
+The following table provides an outline of the features Trivy offers.
+
+
+| Package manager | File         | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|-----------------|--------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
+| [hex][hex]      | mix.lock[^1] |            ✓            |     Excluded     |                  -                   |    ✓     |
+
+## Hex
+In order to detect dependencies, Trivy searches for `mix.lock`[^1].
+
+[Configure](https://hexdocs.pm/mix/Mix.Project.html#module-configuration) your project to use `mix.lock`[^1] file.
+
+[elixir]: https://elixir-lang.org/
+[hex]: https://hex.pm/
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[^1]: `mix.lock` is default name. To scan a custom filename use [file-patterns](../../configuration/skipping.md#file-patterns)

docs/docs/coverage/language/golang.md

@@ -2,12 +2,20 @@
 
 ## Features
 Trivy supports two types of Go scanning, Go Modules and binaries built by Go.
-The following table provides an outline of the features Trivy offers.
 
-| Artifact | Offline[^1] | Dev dependencies |
-|----------|:-----------:|:-----------------|
-| Modules  |      ✓      | Include          |
-| Binaries |      ✓      | Exclude          |
+The following scanners are supported.
+
+| Artifact | SBOM  | Vulnerability | License |
+| -------- | :---: | :-----------: | :-----: |
+| Modules  |   ✓   |       ✓       |  ✓[^2]  |
+| Binaries |   ✓   |       ✓       |    -    |
+
+The table below provides an outline of the features Trivy offers.
+
+| Artifact | Offline[^1] | Dev dependencies | [Dependency graph][dependency-graph] |
+|----------|:-----------:|:-----------------|:----------------------------------:|
+| Modules  |      ✅      | Include          |               ✅[^2]                |
+| Binaries |      ✅      | Exclude          |                 -                  |
 
 !!! note
     Trivy scans only dependencies of the Go project.
@@ -17,10 +25,10 @@ The following table provides an outline of the features Trivy offers.
 ### Go Modules
 Depending on Go versions, the required files are different.
 
-| Version | Required files | Offline | License |
-|---------|:--------------:|:-------:|:-------:|
-| \>=1.17 |     go.mod     |    ✓    |    -    |
-| <1.17   | go.mod, go.sum |    ✓    |    -    |
+| Version | Required files | Offline |
+| ------- | :------------: | :-----: |
+| \>=1.17 |     go.mod     |    ✅    |
+| <1.17   | go.mod, go.sum |    ✅    |
 
 In Go 1.17+ projects, Trivy uses `go.mod` for direct/indirect dependencies.
 On the other hand, it uses `go.mod` for direct dependencies and `go.sum` for indirect dependencies in Go 1.16 or less.
@@ -49,6 +57,10 @@ If you want to have better detection, please consider updating the Go version in
     $ go mod tidy -go=1.18
     ```
 
+To identify licenses and dependency relationships, you need to download modules to local cache beforehand,
+such as `go mod download`, `go mod tidy`, etc.
+Trivy traverses `$GOPATH/pkg/mod` and collects those extra information.
+
 ### Go binaries
 Trivy scans binaries built by Go.
 If there is a Go binary in your container image, Trivy automatically finds and scans it.
@@ -59,4 +71,10 @@ Also, you can scan your local binaries.
 $ trivy fs ./your_binary
 ```
 
-[^1]: It doesn't require the Internet access.
+!!! note
+    It doesn't work with UPX-compressed binaries.
+
+[^1]: It doesn't require the Internet access.
+[^2]: Need to download modules to local cache beforehand
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/language/index.md

@@ -0,0 +1,67 @@
+# Programming Language
+
+Trivy supports programming languages for 
+
+- [SBOM][sbom]
+- [Vulnerabilities][vuln]
+- [Licenses][license]
+
+## Supported languages
+The files analyzed vary depending on the target.
+This is because Trivy primarily categorizes targets into two groups:
+
+- Pre-build
+- Post-build
+
+If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files.
+On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like `.gemspec`, binary files, and so on.
+
+| Language             | File                                                                                       | Image[^5] | Rootfs[^6] | Filesystem[^7] | Repository[^8] |
+|----------------------|--------------------------------------------------------------------------------------------|:---------:|:----------:|:--------------:|:--------------:|
+| [Ruby](ruby.md)      | Gemfile.lock                                                                               |     -     |     -      |       ✅        |       ✅        |
+|                      | gemspec                                                                                    |     ✅     |     ✅      |       -        |       -        |
+| [Python](python.md)  | Pipfile.lock                                                                               |     -     |     -      |       ✅        |       ✅        |
+|                      | poetry.lock                                                                                |     -     |     -      |       ✅        |       ✅        |
+|                      | requirements.txt                                                                           |     -     |     -      |       ✅        |       ✅        |
+|                      | egg package[^1]                                                                            |     ✅     |     ✅      |       -        |       -        |
+|                      | wheel package[^2]                                                                          |     ✅     |     ✅      |       -        |       -        |
+|                      | conda package[^3]                                                                          |     ✅     |     ✅      |       -        |       -        |
+| [PHP](php.md)        | composer.lock                                                                              |     ✅     |     ✅      |       ✅        |       ✅        |
+| [Node.js](nodejs.md) | package-lock.json                                                                          |     -     |     -      |       ✅        |       ✅        |
+|                      | yarn.lock                                                                                  |     -     |     -      |       ✅        |       ✅        |
+|                      | pnpm-lock.yaml                                                                             |     -     |     -      |       ✅        |       ✅        |
+|                      | package.json                                                                               |     ✅     |     ✅      |       -        |       -        |
+| [.NET](dotnet.md)    | packages.lock.json                                                                         |     ✅     |     ✅      |       ✅        |       ✅        |
+|                      | packages.config                                                                            |     ✅     |     ✅      |       ✅        |       ✅        |
+|                      | .deps.json                                                                                 |     ✅     |     ✅      |       ✅        |       ✅        |
+| [Java](java.md)      | JAR/WAR/PAR/EAR[^4]                                                                        |     ✅     |     ✅      |       -        |       -        |
+|                      | pom.xml                                                                                    |     -     |     -      |       ✅        |       ✅        |
+|                      | *gradle.lockfile                                                                           |     -     |     -      |       ✅        |       ✅        |
+| [Go](golang.md)      | Binaries built by Go                                                                       |     ✅     |     ✅      |       -        |       -        |
+|                      | go.mod                                                                                     |     -     |     -      |       ✅        |       ✅        |
+| [Rust](rust.md)      | Cargo.lock                                                                                 |     ✅     |     ✅      |       ✅        |       ✅        |
+|                      | Binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) |     ✅     |     ✅      |       -        |       -        |
+| [C/C++](c.md)        | conan.lock                                                                                 |     -     |     -      |       ✅        |       ✅        |
+| [Elixir](elixir.md)  | mix.lock[^10]                                                                              |     -     |     -      |       ✅        |       ✅        |
+| [Dart](dart.md)      | pubspec.lock                                                                               |     -     |     -      |       ✅        |       ✅        |
+| [Swift](swift.md)    | Podfile.lock                                                                               |     -     |     -      |       ✅        |       ✅        |
+|                      | Package.resolved                                                                           |     -     |     -      |       ✅        |       ✅        |
+
+The path of these files does not matter.
+
+Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Dockerfile)
+
+[sbom]: ../../supply-chain/sbom.md
+[vuln]: ../../scanner/vulnerability.md
+[license]: ../../scanner/license.md
+
+[^1]: `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO`
+[^2]: `.dist-info/META-DATA`
+[^3]: `envs/*/conda-meta/*.json`
+[^4]: `*.jar`, `*.war`, `*.par` and `*.ear`
+[^5]: ✅ means "enabled" and `-` means "disabled" in the image scanning
+[^6]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning
+[^7]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning
+[^8]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning
+[^9]: ✅ means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in [json](../../configuration/reporting.md#json) and [sarif](../../configuration/reporting.md#sarif) formats. SARIF uses `startline == 1 and endline == 1` for unsupported file types
+[^10]: To scan a filename other than the default filename use [file-patterns](../../configuration/skipping.md#file-patterns)

docs/docs/coverage/language/java.md

@@ -1,24 +1,31 @@
 # Java
-
 Trivy supports three types of Java scanning: `JAR/WAR/PAR/EAR`, `pom.xml` and `*gradle.lockfile` files.
+
+Each artifact supports the following scanners:
+
+| Artifact         | SBOM  | Vulnerability | License |
+| ---------------- | :---: | :-----------: | :-----: |
+| JAR/WAR/PAR/EAR  |   ✓   |       ✓       |    -    |
+| pom.xml          |   ✓   |       ✓       |    ✓    |
+| *gradle.lockfile |   ✓   |       ✓       |    -    |
+
 The following table provides an outline of the features Trivy offers.
 
-
-| Artifact         |    Internet access    | Dev dependencies |
-|------------------|:---------------------:|:-----------------|
-| JAR/WAR/PAR/EAR  |     Trivy Java DB     | Include          |
-| pom.xml          | Maven repository [^1] | Exclude          |
-| *gradle.lockfile |           -           | Exclude          |
+| Artifact         |    Internet access    | Dev dependencies | [Dependency graph][dependency-graph] |
+|------------------|:---------------------:|:----------------:|:------------------------------------:|
+| JAR/WAR/PAR/EAR  |     Trivy Java DB     |     Include      |                  -                   |
+| pom.xml          | Maven repository [^1] |     Exclude      |                  ✓                   |
+| *gradle.lockfile |           -           |     Exclude      |                  -                   |
 
 These may be enabled or disabled depending on the target.
-See [here](../detection/language.md) for the detail.
+See [here](./index.md) for the detail.
 
 ## JAR/WAR/PAR/EAR
 To find information about your JAR[^2] file, Trivy parses `pom.properties` and `MANIFEST.MF` files in your JAR[^2] file and takes required properties[^3].
 
 If those files don't exist or don't contain enough information - Trivy will try to find this JAR[^2] file in [trivy-java-db](https://github.com/aquasecurity/trivy-java-db).
 The Java DB will be automatically downloaded/updated when any JAR[^2] file is found.
-It is stored in [the cache directory](../examples/cache.md#cache-directory).
+It is stored in [the cache directory](../../configuration/cache.md#cache-directory).
 
 !!! warning "EXPERIMENTAL"
     Finding JARs in `trivy-java-db` is an experimental function.
@@ -26,6 +33,8 @@ It is stored in [the cache directory](../examples/cache.md#cache-directory).
 Base JAR[^2] may contain inner JARs[^2] within itself.
 To find information about these JARs[^2], the same logic is used as for the base JAR[^2].
 
+`table` format only contains the name of root JAR[^2] . To get the full path to inner JARs[^2] use the `json` format.
+
 ## pom.xml
 Trivy parses your `pom.xml` file and tries to find files with dependencies from these local locations.
 
@@ -37,7 +46,7 @@ If your machine doesn't have the necessary files - Trivy tries to find the infor
 
 !!! Note
     Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the `maven repository`.
-    Information about data sources for Java you can see [here](../detection/data-source.md).
+    Information about data sources for Java you can see [here](../../scanner/vulnerability.md#data-sources_1).
 
 You can disable connecting to the maven repository with the `--offline-scan` flag.
 The `--offline-scan` flag does not affect the Trivy database.
@@ -57,4 +66,6 @@ It doesn't require the internet access.
 [^3]: `ArtifactID`, `GroupID` and `Version`
 [^4]: e.g. when parent pom.xml file has `../pom.xml` path
 [^5]: When you use dependency path in `relativePath` field in pom.xml file
-[^6]: `/Users/<username>/.m2/repository` (for Linux and Mac) and `C:/Users/<username>/.m2/repository` (for Windows) by default
+[^6]: `/Users/<username>/.m2/repository` (for Linux and Mac) and `C:/Users/<username>/.m2/repository` (for Windows) by default
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/language/nodejs.md

@@ -0,0 +1,60 @@
+# Node.js
+
+Trivy supports three types of Node.js package managers: `npm`, `Yarn` and `pnpm`.
+
+The following scanners are supported.
+
+| Artifact | SBOM  | Vulnerability | License |
+| -------- | :---: | :-----------: | :-----: |
+| npm      |   ✓   |       ✓       |    ✓    |
+| Yarn     |   ✓   |       ✓       |    ✓    |
+| pnpm     |   ✓   |       ✓       |    -    |
+
+The following table provides an outline of the features Trivy offers.
+
+| Package manager | File              | Transitive dependencies | Dev dependencies  | [Dependency graph][dependency-graph] | Position |
+|:---------------:|-------------------|:-----------------------:|:-----------------:|:------------------------------------:|:--------:|
+|       npm       | package-lock.json |            ✓            | [Excluded](#npm)  |                  ✓                   |    ✓     |
+|      Yarn       | yarn.lock         |            ✓            | [Excluded](#yarn) |                  ✓                   |    ✓     |
+|      pnpm       | pnpm-lock.yaml    |            ✓            |     Excluded      |                  ✓                   |    -     |
+
+In addition, Trivy scans installed packages with `package.json`.
+
+| File         | Dependency graph | Position | License |
+| ------------ | :--------------: | :------: | :-----: |
+| package.json |        -         |    -     |    ✅    |
+
+These may be enabled or disabled depending on the target.
+See [here](./index.md) for the detail.
+
+## Package managers
+Trivy parses your files generated by package managers in filesystem/repository scanning.
+
+!!! tip
+    Please make sure your lock file is up-to-date after modifying `package.json`.
+
+### npm
+Trivy parses `package-lock.json`.
+To identify licenses, you need to download dependencies to `node_modules` beforehand.
+Trivy analyzes `node_modules` for licenses.
+
+By default, Trivy doesn't report development dependencies. Use the `--include-dev-deps` flag to include them.
+
+### Yarn
+Trivy parses `yarn.lock`, which doesn't contain information about development dependencies.
+To exclude devDependencies, `package.json` also needs to be present next to `yarn.lock`. 
+Trivy analyzes `.yarn` (Yarn 2+) or `node_modules` (Yarn Classic) folder next to the yarn.lock file to detect licenses.
+
+By default, Trivy doesn't report development dependencies. Use the `--include-dev-deps` flag to include them.
+
+### pnpm
+Trivy parses `pnpm-lock.yaml`, then finds production dependencies and builds a [tree][dependency-graph] of dependencies with vulnerabilities.
+
+## Packages
+Trivy parses the manifest files of installed packages in container image scanning and so on.
+
+### package.json
+Trivy searches for `package.json` files under `node_modules` and identifies installed packages.
+It only extracts package names, versions and licenses for those packages.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/language/php.md

@@ -0,0 +1,26 @@
+# PHP
+
+Trivy supports [Composer][composer], which is a tool for dependency management in PHP.
+
+The following scanners are supported.
+
+| Package manager | SBOM  | Vulnerability | License |
+| --------------- | :---: | :-----------: | :-----: |
+| Composer        |   ✓   |       ✓       |    ✓    |
+
+The following table provides an outline of the features Trivy offers.
+
+
+| Package manager | File          | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|-----------------|---------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
+| Composer        | composer.lock |            ✓            |     Excluded     |                  ✓                   |    ✓     |
+
+## Composer
+In order to detect dependencies, Trivy searches for `composer.lock`.
+
+Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project.
+Since this information is not included in `composer.lock`, Trivy parses `composer.json`, which should be located next to `composer.lock`.
+If you want to see the dependency tree, please ensure that `composer.json` is present.
+
+[composer]: https://getcomposer.org/
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/language/python.md

@@ -0,0 +1,94 @@
+# Python
+
+Trivy supports three types of Python package managers: `pip`, `Pipenv` and `Poetry`.
+The following scanners are supported for package managers.
+
+| Package manager | SBOM  | Vulnerability | License |
+| --------------- | :---: | :-----------: | :-----: |
+| pip             |   ✓   |       ✓       |    -    |
+| Pipenv          |   ✓   |       ✓       |    -    |
+| Poetry          |   ✓   |       ✓       |    -    |
+
+In addition, Trivy supports three formats of Python packages: `egg`, `wheel` and `conda`.
+The following scanners are supported for Python packages.
+
+| Packaging | SBOM  | Vulnerability | License |
+| --------- | :---: | :-----------: | :-----: |
+| Egg       |   ✓   |       ✓       |    ✓    |
+| Wheel     |   ✓   |       ✓       |    ✓    |
+| Conda     |   ✓   |       -       |    -    |
+
+
+The following table provides an outline of the features Trivy offers.
+
+| Package manager | File             | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|-----------------|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
+| pip             | requirements.txt |            -            |     Include      |                  -                   |    -     |
+| Pipenv          | Pipfile.lock     |            ✓            |     Include      |                  -                   |    ✓     |
+| Poetry          | poetry.lock      |            ✓            |     Exclude      |                  ✓                   |          |
+
+
+| Packaging | Dependency graph |
+| --------- | :--------------: |
+| Egg       |        ✓         |
+| Wheel     |        ✓         |
+
+These may be enabled or disabled depending on the target.
+See [here](./index.md) for the detail.
+
+## Package managers
+Trivy parses your files generated by package managers in filesystem/repository scanning.
+
+### pip
+`requirements.txt` files usually contain only the direct dependencies and not contain the transitive dependencies.
+Therefore, Trivy scans only for the direct dependencies with `requirements.txt`.
+
+To detect transitive dependencies as well, you need to generate `requirements.txt` with `pip freeze`.
+
+```zsh
+$ cat requirements.txt # it will only find `requests@2.28.2`.
+requests==2.28.2 
+$ pip install -r requirements.txt
+...
+
+$ pip freeze > requirements.txt   
+$ cat requirements.txt # it will also find the transitive dependencies of `requests@2.28.2`.
+certifi==2022.12.7
+charset-normalizer==3.1.0
+idna==3.4
+PyJWT==2.1.0
+requests==2.28.2
+urllib3==1.26.15
+```
+
+`pip freeze` also helps to resolve [extras](https://packaging.python.org/en/latest/tutorials/installing-packages/#installing-extras)(optional) dependencies (like `package[extras]=0.0.0`).
+
+`requirements.txt` files don't contain information about dependencies used for development.
+Trivy could detect vulnerabilities on the development packages, which not affect your production environment.
+
+License detection is not supported for `pip`.
+
+### Pipenv
+Trivy parses `Pipfile.lock`.
+`Pipfile.lock` files don't contain information about dependencies used for development.
+Trivy could detect vulnerabilities on the development packages, which not affect your production environment.
+
+License detection is not supported for `Pipenv`.
+
+### Poetry
+Trivy uses `poetry.lock` to identify dependencies and find vulnerabilities.
+To build the correct dependency graph, `pyproject.toml` also needs to be present next to `poetry.lock`.
+
+License detection is not supported for `Poetry`.
+
+## Packaging
+Trivy parses the manifest files of installed packages in container image scanning and so on.
+See [here](https://packaging.python.org/en/latest/discussions/wheel-vs-egg/) for the detail.
+
+### Egg
+Trivy looks for `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO` to identify Python packages.
+
+### Wheel
+Trivy looks for `.dist-info/META-DATA` to identify Python packages.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/language/ruby.md

@@ -0,0 +1,30 @@
+# Ruby
+
+Trivy supports [Bundler][bundler] and [RubyGems][rubygems].
+The following scanners are supported for Cargo.
+
+| Package manager | SBOM | Vulnerability | License |
+|-----------------|:----:|:-------------:|:-------:|
+| Bundler         |  ✓   |       ✓       |    -    |
+| RubyGems        |  ✓   |       ✓       |    ✓    |
+
+
+The following table provides an outline of the features Trivy offers.
+
+| Package manager | File         | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|-----------------|--------------|:-----------------------:|:-----------------|:------------------------------------:|:--------:|
+| Bundler         | Gemfile.lock |            ✓            | Included         |                  ✓                   |    ✓     |
+| RubyGems        | .gemspec     |            -            | Included         |                  -                   |    -     |
+
+
+### Bundler
+Trivy searches for `Gemfile.lock` to detect dependencies. 
+
+
+### RubyGems
+`.gemspec` files doesn't contains transitive dependencies. You need to scan each `.gemspec` file separately.
+
+[bundler]: https://bundler.io
+[rubygems]: https://rubygems.org/
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+

docs/docs/coverage/language/rust.md

@@ -0,0 +1,44 @@
+# Rust
+
+Trivy supports [Cargo](https://doc.rust-lang.org/stable/cargo/), which is the Rust package manager.
+The following scanners are supported for Cargo.
+
+| Package manager | SBOM  | Vulnerability | License |
+| --------------- | :---: | :-----------: | :-----: |
+| Cargo           |   ✓   |       ✓       |    -    |
+
+In addition, it supports binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable).
+
+| Artifact | SBOM  | Vulnerability | License |
+| -------- | :---: | :-----------: | :-----: |
+| Binaries |   ✓   |       ✓       |    -    |
+
+## Features
+The following table provides an outline of the features Trivy offers.
+
+| Package manager | File       | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|-----------------|------------|:-----------------------:|:-----------------|:------------------------------------:|:--------:|
+| Cargo           | Cargo.lock |            ✓            | Excluded[^1]     |                  ✓                   |    ✓     |
+
+
+| Artifact | Transitive dependencies | Dev dependencies | Dependency graph | Position |
+| -------- | :---------------------: | :--------------- | :--------------: | :------: |
+| Binaries |            ✓            | Excluded         |        -         |    -     |
+
+
+### Cargo
+Trivy searches for `Cargo.lock` to detect dependencies.
+
+Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project.
+Since this information is not included in `Cargo.lock`, Trivy parses `Cargo.toml`, which should be located next to `Cargo.lock`.
+If you want to see the dependency tree, please ensure that `Cargo.toml` is present.
+
+Scan `Cargo.lock` and `Cargo.toml` together also removes developer dependencies.
+
+### Binaries
+Trivy scans binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable).
+If such a binary exists, Trivy will identify it as being built with cargo-audit and scan it.
+
+[^1]: When you scan Cargo.lock and Cargo.toml together.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/language/swift.md

@@ -0,0 +1,44 @@
+# Swift
+
+Trivy supports [CocoaPods][cocoapods] and [Swift][swift] package managers.
+
+The following scanners are supported.
+
+| Package manager | SBOM | Vulnerability | License |
+|-----------------|:----:|:-------------:|:-------:|
+| Swift           |  ✓   |       ✓       |    -    |
+| CocoaPods       |  ✓   |       ✓       |    -    |
+
+The following table provides an outline of the features Trivy offers.
+
+| Package manager | File             | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|:---------------:|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
+|      Swift      | Package.resolved |            ✓            |     Included     |                  -                   |    ✓     |
+|    CocoaPods    | Podfile.lock     |            ✓            |     Included     |                  ✓                   |    -     |
+
+These may be enabled or disabled depending on the target.
+See [here](./index.md) for the detail.
+
+## Swift
+Trivy parses [Package.resolved][package-resolved] file to find dependencies.
+Don't forget to update (`swift package update` command) this file before scanning.
+
+## CocoaPods
+CocoaPods uses package names in `PodFile.lock`, but [GitHub Advisory Database (GHSA)][ghsa] Trivy relies on uses Git URLs. 
+We parse [the CocoaPods Specs][cocoapods-specs] to match package names and links.
+
+!!! note "Limitation"
+    Since [GHSA][ghsa] holds only Git URLs, such as github.com/apple/swift-nio, 
+    Trivy can't identify affected submodules, and detect all submodules maintained by the same URL.
+    For example, [SwiftNIOHTTP1][niohttp1] and [SwiftNIOWebSocket][niowebsocket] both are maintained under `github.com/apple/swift-nio`,
+    and Trivy detect CVE-2022-3215 for both of them, even though only [SwiftNIOHTTP1][niohttp1] is actually affected.
+
+[cocoapods]: https://cocoapods.org/
+[cocoapods-specs]: https://github.com/CocoaPods/Specs
+[ghsa]: https://github.com/advisories?query=type%3Areviewed+ecosystem%3Aswift
+[swift]: https://www.swift.org/package-manager/
+[package-resolved]: https://github.com/apple/swift-package-manager/blob/4a42f2519e3f7b8a731c5ed89b47ed577df8f86c/Documentation/Usage.md#resolving-versions-packageresolved-file
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[niohttp1]: https://cocoapods.org/pods/SwiftNIOHTTP1
+[niowebsocket]: https://cocoapods.org/pods/SwiftNIOWebSocket

docs/docs/coverage/os/alma.md

@@ -0,0 +1,73 @@
+# AlmaLinux
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
+
+## Vulnerability
+AlmaLinux offers its own security advisories, and these are utilized when scanning AlmaLinux for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+When looking at fixed versions, it's crucial to consider the patches supplied by AlmaLinux.
+For example, for CVE-2023-0464, the fixed version for AlmaLinux 9 is listed as `3.0.7-16.el9_2` in [their advisory][ALSA-2023:3722].
+Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and son on.
+Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
+
+### Severity
+Trivy calculates the severity of an issue based on the severity provided by AlmaLinux.
+If the severity is not provided or defined yet by AlmaLinux, the severity from the NVD is taken into account.
+
+Using CVE-2023-0464 as an example, while it is rated as "High" in NVD, AlmaLinux has marked as ["moderate"][ALSA-2023:3722].
+As a result, Trivy will display it as "Medium".
+
+The table below is the mapping of AlmaLinux's severity to Trivy's severity levels.
+
+| AlmaLinux |  Trivy   |
+| :-------: | :------: |
+|    Low    |   Low    |
+| Moderate  |  Medium  |
+| Important |   High   |
+| Critical  | Critical |
+
+### Status
+Trivy supports the following [vulnerability statuses] for AlmaLinux.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[errata]: https://errata.almalinux.org/
+
+[ALSA-2023:3722]: https://errata.almalinux.org/9/ALSA-2023-3722.html
+[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/alpine.md

@@ -0,0 +1,59 @@
+# Alpine Linux
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through `apk`.
+
+## Vulnerability
+Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+When looking at fixed versions, it's crucial to consider the patches supplied by Alpine.
+For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as `3.1.0-r1` in [the secfixes][CVE-2023-0464].
+Note that this is different from the upstream fixed version, which is `3.1.1`.
+Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
+
+### Severity
+For Alpine vulnerabilities, the severity is determined using the values set by NVD.
+
+### Status
+Trivy supports the following [vulnerability statuses] for Alpine.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+## License
+Trivy identifies licenses by examining the metadata of APK packages.
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[secdb]: https://secdb.alpinelinux.org/
+
+[CVE-2023-0464]: https://gitlab.alpinelinux.org/alpine/aports/-/blob/dad5b7380ab3be705951ce6fd2d7bba513d6a744/main/openssl/APKBUILD#L36-37
+[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/amazon.md

@@ -0,0 +1,72 @@
+# Amazon Linux
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
+
+## Vulnerability
+Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+When looking at fixed versions, it's crucial to consider the patches supplied by Amazon.
+For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as `3.0.8-1.amzn2023.0.2` in [ALAS2023-2023-181].
+Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and so on.
+Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
+
+### Severity
+Trivy determines vulnerability severity based on the severity metric provided by Amazon.
+For example, the security patch for [CVE-2023-0464] in Amazon Linux 2023 is provided as [ALAS2023-2023-181].
+Its severity is rated as "Medium".
+Thus, even though it's evaluated as "HIGH" in the NVD, Trivy displays it with a severity of "MEDIUM".
+
+The table below is the mapping of Amazon's severity to Trivy's severity levels.
+
+|  Amazon   |  Trivy   |
+| :-------: | :------: |
+|    Low    |   Low    |
+|  Medium   |  Medium  |
+| Important |   High   |
+| Critical  | Critical |
+
+### Status
+Trivy supports the following [vulnerability statuses] for Amazon Linux.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[center]: https://alas.aws.amazon.com/
+
+[CVE-2023-0464]: https://alas.aws.amazon.com/cve/html/CVE-2023-0464.html
+[ALAS2023-2023-181]: https://alas.aws.amazon.com/AL2023/ALAS-2023-181.html
+[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/bitnami.md

@@ -0,0 +1,63 @@
+# Bitnami Images
+
+!!! warning "EXPERIMENTAL"
+    Scanning results may be inaccurate.
+
+While it is not an OS, this page describes the details of the [container images provided by Bitnami](https://github.com/bitnami/containers).
+Bitnami images are based on [Debian](debian.md).
+Please see [the Debian page](debian.md) for OS packages.
+
+Trivy supports the following scanners for Bitnami packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+| :----------------------------------: | :-------: |
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     -     |
+
+## SBOM
+Trivy analyzes the SBOM information contained within the container images provided by Bitnami.
+The SBOM files are located at `/opt/bitnami/<component>/.spdx-<component>.spdx`.
+
+## Vulnerability
+Since Bitnami has its [own vulnerability database][vulndb], it uses these for vulnerability detection of applications and packages distributed by Bitnami.
+
+!!! note
+    Trivy does not support vulnerability detection of independently compiled binaries, so even if you scan container images like `nginx:1.15.2`, vulnerabilities in Nginx cannot be detected.
+    This is because main applications like Nginx are [not installed by the package manager](https://github.com/nginxinc/docker-nginx/blob/321a13a966eeff945196ddd31a629dad2aa85eda/mainline/debian/Dockerfile).
+    However, in the case of Bitnami images, since these SBOMs are stored within the image, scanning `bitnami/nginx:1.15.2` allows for the detection of vulnerabilities in Nginx.
+
+### Fixed Version
+Trivy refers to the [Bitnami database][vulndb]. Please note that these may differ from the upstream fixed versions.
+
+### Severity
+Similar to Fixed versions, it follows Bitnami's vulnerability database.
+
+### Status
+Trivy supports the following [vulnerability statuses] for Bitnami packages.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+
+
+## License
+If licenses are included in the SBOM distributed by Bitnami, they will be used for scanning.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[vulndb]: https://github.com/bitnami/vulndb
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/cbl-mariner.md

@@ -0,0 +1,66 @@
+# CBL-Mariner
+Trivy supports the following scanners for OS packages.
+
+| Version          | SBOM  | Vulnerability | License |
+| ---------------- | :---: | :-----------: | :-----: |
+| 1.0              |   ✔   |       ✔       |    ✔    |
+| 1.0 (Distroless) |   ✔   |       ✔       |         |
+| 2.0              |   ✔   |       ✔       |    ✔    |
+| 2.0 (Distroless) |   ✔   |       ✔       |         |
+
+
+The following table provides an outline of the targets Trivy supports.
+
+| Version | Container image | Virtual machine |     Arch     |
+| ------- | :-------------: | :-------------: | :----------: |
+| 1.0     |        ✔        |        ✔        | amd64, arm64 |
+| 2.0     |        ✔        |        ✔        | amd64, arm64 |
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|    Detect unfixed vulnerabilities    |     ✓     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
+
+## Vulnerability
+CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+Trivy takes fixed versions from [CBL-Mariner OVAL][oval].
+
+### Severity
+Trivy calculates the severity of an issue based on the severity provided in [CBL-Mariner OVAL][oval].
+
+### Status
+Trivy supports the following [vulnerability statuses] for CBL-Mariner.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+!!! note
+    License detection is not supported for CBL-Mariner Distroless.
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[cbl-mariner]: https://github.com/microsoft/CBL-Mariner
+
+[oval]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/centos.md

@@ -0,0 +1,38 @@
+# CentOS
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|                Feature                | Supported |
+| :-----------------------------------: | :-------: |
+|        Unfixed vulnerabilities        |     ✓     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Same as [RHEL](rhel.md#sbom).
+
+## Vulnerability
+CentOS does not provide straightforward machine-readable security advisories.
+As a result, Trivy utilizes the security advisories from [Red Hat Enterprise Linux (RHEL)](rhel.md#vulnerability) for detecting vulnerabilities in CentOS.
+This approach might lead to situations where, even though Trivy displays a fixed version, CentOS might not have the patch available yet.
+Since patches released for RHEL often become available in CentOS after some time, it's usually just a matter of waiting.
+
+!!! note
+    The case for CentOS Stream, which is not supported by Trivy, is entirely different from CentOS.
+
+As Trivy relies on Red Hat's advisories, please refer to [Red Hat](rhel.md) for details regarding vulnerability severity and status.
+
+
+## License
+Same as [RHEL](rhel.md#license).
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

docs/docs/coverage/os/chainguard.md

@@ -0,0 +1,32 @@
+# Chainguard
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+The table below outlines the features offered by Trivy.
+
+|                Feature                | Supported |
+| :-----------------------------------: | :-------: |
+|    Detect unfixed vulnerabilities     |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Same as [Alpine Linux](alpine.md#sbom).
+
+## Vulnerability
+Chainguard offers its own security advisories, and these are utilized when scanning Chainguard for vulnerabilities.
+Everything else is the same as [Alpine Linux](alpine.md#vulnerability).
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+## License
+Same as [Alpine Linux](alpine.md#license).
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[secdb]: https://packages.cgr.dev/chainguard/security.json

docs/docs/coverage/os/debian.md

@@ -0,0 +1,74 @@
+# Debian
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|                Feature                | Supported |
+| :-----------------------------------: | :-------: |
+|        Unfixed vulnerabilities        |     ✓     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `apt` and `dpkg`.
+While there are some exceptions, like Go binaries and JAR files, it's important to note that binaries that have been custom-built using `make` or tools installed via `curl` are generally not detected.
+
+## Vulnerability
+Debian offers its own security advisories, and these are utilized when scanning Debian for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+When looking at fixed versions, it's crucial to consider the patches supplied by Debian.
+For example, for CVE-2023-3269, the fixed version for Debian 12 (bookworm) is listed as `6.1.37-1` in [the Security Tracker][CVE-2023-3269].
+This patch is provided in [DSA-5448-1].
+Note that this is different from the upstream fixed version, which is `6.5`.
+Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
+
+### Severity
+Trivy calculates the severity of an issue based on the 'Urgency' metric found in the Security Tracker.
+If 'Urgency' isn't provided by Debian, the severity from the NVD is taken into account.
+
+Using CVE-2019-15052 as an example, while it is rated as "Critical" in NVD, Debian has marked its "Urgency" as ["Low"][CVE-2019-15052].
+As a result, Trivy will display it as "Low".
+
+### Status
+Trivy supports the following [vulnerability statuses] for Debian.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |     ✓     |
+|     End of Life     |     ✓     |
+
+## License
+To identify the license of a package, Trivy checks the copyright file located at `/usr/share/doc/*/copyright`.
+
+However, this method has its limitations as the file isn't machine-readable, leading to situations where the license isn't detected.
+In such scenarios, the `--license-full` flag can be passed.
+It compares the contents of known licenses with the copyright file to discern the license in question.
+Please be aware that using this flag can increase memory usage, so it's disabled by default for efficiency.
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[debian-tracker]: https://security-tracker.debian.org/tracker/
+[debian-oval]: https://www.debian.org/security/oval/
+
+[CVE-2023-3269]: https://security-tracker.debian.org/tracker/CVE-2023-3269
+[CVE-2019-15052]: https://security-tracker.debian.org/tracker/CVE-2019-15052
+[DSA-5448-1]: https://security-tracker.debian.org/tracker/DSA-5448-1
+[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-3269
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/google-distroless.md

@@ -0,0 +1,34 @@
+# Google Distroless Images
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+| :----------------------------------: | :-------: |
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages pre-installed in distroless images.
+
+## Vulnerability
+Google Distroless is based on [Debian]; see there for details.
+
+## License
+Google Distroless is based on [Debian]; see there for details.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[metadata]: https://packages.vmware.com/photon/photon_cve_metadata/
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status
+
+[Debian]: debian.md

docs/docs/coverage/os/index.md

@@ -0,0 +1,45 @@
+# OS
+
+## Scanner
+Trivy supports operating systems for 
+
+- [SBOM][sbom]
+- [Vulnerabilities][vuln]
+- [Licenses][license]
+
+## Supported OS
+
+| OS                                            | Supported Versions                  | Package Managers |
+|-----------------------------------------------|-------------------------------------|------------------|
+| [Alpine Linux](alpine.md)                     | 2.2 - 2.7, 3.0 - 3.18, edge         | apk              |
+| [Wolfi Linux](wolfi.md)                       | (n/a)                               | apk              |
+| [Chainguard](chainguard.md)                   | (n/a)                               | apk              |
+| [Red Hat Enterprise Linux](rhel.md)           | 6, 7, 8                             | dnf/yum/rpm      |
+| [CentOS](centos.md)[^1]                       | 6, 7, 8                             | dnf/yum/rpm      |
+| [AlmaLinux](alma.md)                          | 8, 9                                | dnf/yum/rpm      |
+| [Rocky Linux](rocky.md)                       | 8, 9                                | dnf/yum/rpm      |
+| [Oracle Linux](oracle.md)                     | 5, 6, 7, 8                          | dnf/yum/rpm      |
+| [CBL-Mariner](cbl-mariner.md)                 | 1.0, 2.0                            | dnf/yum/rpm      |
+| [Amazon Linux](amazon.md)                     | 1, 2, 2023                          | dnf/yum/rpm      |
+| [openSUSE Leap](suse.md)                      | 42, 15                              | zypper/rpm       |
+| [SUSE Enterprise Linux](suse.md)              | 11, 12, 15                          | zypper/rpm       |
+| [Photon OS](photon.md)                        | 1.0, 2.0, 3.0, 4.0                  | tndf/yum/rpm     |
+| [Debian GNU/Linux](debian.md)                 | 7, 8, 9, 10, 11, 12                 | apt/dpkg         |
+| [Ubuntu](ubuntu.md)                           | All versions supported by Canonical | apt/dpkg         |
+
+## Supported container images
+
+| Container image                               | Supported Versions                  | Package Managers |
+|-----------------------------------------------|-------------------------------------|------------------|
+| [Google Distroless](google-distroless.md)[^2] | Any                                 | apt/dpkg         |
+| [Bitnami](bitnami.md)                         | Any                                 | -                |
+
+Each page gives more details.
+
+[^1]: CentOS Stream is not supported 
+[^2]: https://github.com/GoogleContainerTools/distroless
+
+
+[sbom]: ../../supply-chain/sbom.md
+[vuln]: ../../scanner/vulnerability.md
+[license]: ../../scanner/license.md

docs/docs/coverage/os/oracle.md

@@ -0,0 +1,70 @@
+# Oracle Linux
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|                Feature                | Supported |
+| :-----------------------------------: | :-------: |
+|        Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
+
+## Vulnerability
+Oracle Linux offers its own security advisories, and these are utilized when scanning Oracle Linux for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+Trivy takes fixed versions from [Oracle security advisories][alerts].
+
+### Severity
+Trivy determines vulnerability severity based on the severity metric provided in [Oracle security advisories][alerts].
+For example, the security patch for [CVE-2023-0464][CVE-2023-0464] is provided as [ELSA-2023-2645][ELSA-2023-2645].
+Its severity is rated as "MODERATE".
+Thus, even though it's evaluated as "HIGH" in the NVD, Trivy displays it with a severity of "MEDIUM".
+
+The table below is the mapping of Oracle's threat to Trivy's severity levels.
+
+|  Oracle   |  Trivy   |
+| :-------: | :------: |
+|    Low    |   Low    |
+| Moderate  |  Medium  |
+| Important |   High   |
+| Critical  | Critical |
+
+### Status
+Trivy supports the following [vulnerability statuses] for Oracle Linux.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[oval]: https://linux.oracle.com/security/oval/
+[alerts]: https://www.oracle.com/security-alerts/
+
+[CVE-2023-0464]: https://linux.oracle.com/cve/CVE-2023-0464.html
+[ELSA-2023-2645]: https://linux.oracle.com/errata/ELSA-2023-2645.html
+[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/photon.md

@@ -0,0 +1,54 @@
+# Photon OS
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `tdnf` and `yum`.
+
+## Vulnerability
+Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+Trivy takes fixed versions from [Photon CVE metadata][metadata].
+
+### Severity
+Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS.
+See [here](../../scanner/vulnerability.md#severity-selection) for the conversion table from CVSS score to severity.
+
+### Status
+Trivy supports the following [vulnerability statuses] for Photon OS.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[metadata]: https://packages.vmware.com/photon/photon_cve_metadata/
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/rhel.md

@@ -0,0 +1,84 @@
+# Red Hat Enterprise Linux
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+| :----------------------------------: | :-------: |
+|       Unfixed vulnerabilities        |     ✓     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
+
+## Vulnerability
+Red Hat offers its own security advisories, and these are utilized when scanning Red Hat Enterprise Linux (RHEL) for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+When looking at fixed versions, it's crucial to consider the patches supplied by Red Hat.
+For example, for CVE-2023-0464, the fixed version for RHEL 9 is listed as `3.0.7-16.el9_2` in [their advisory][CVE-2023-0464].
+This patch is provided in [RHSA-2023:3722].
+Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and so on.
+Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
+
+### Severity
+Trivy calculates the severity of a vulnerability based on the 'Impact' metric provided by Red Hat.
+If the impact is not provided or defined yet by Red Hat, the severity from the NVD is taken into account.
+
+Using CVE-2023-0464 as an example, while it is rated as "HIGH" in NVD, Red Hat has marked its 'Impact' as ["Low"][CVE-2023-0464].
+As a result, Trivy will display it as "Low".
+
+The table below is the mapping of Red Hat's impact to Trivy's severity levels.
+
+|  Red Hat  |  Trivy   |
+| :-------: | :------: |
+|    Low    |   Low    |
+| Moderate  |  Medium  |
+| Important |   High   |
+| Critical  | Critical |
+
+### Status
+Trivy supports the following [vulnerability statuses] for RHEL.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |     ✓     |
+|    Will Not Fix     |     ✓     |
+|    Fix Deferred     |     ✓     |
+|     End of Life     |     ✓     |
+
+When a vulnerability status is listed as "End of Life", it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current support lifecycle phase.
+The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed.
+Red Hat advises that the product should be assumed to be affected.
+Therefore, Trivy detects vulnerabilities with this status as "End of Life".
+
+On the other hand, for those marked "Under Investigation," the impact is unclear as they are still being examined, so Trivy does not detect them. Once the investigation is completed, the status should be updated.
+
+!!! abstract
+    Vulnerabilities with a status of "End of Life", where the presence or absence of impact is unclear, are detected by Trivy. However, those with a status of "Under Investigation" are not detected.
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[oval]: https://www.redhat.com/security/data/oval/v2/
+[api]: https://www.redhat.com/security/data/metrics/
+
+[CVE-2023-0464]: https://access.redhat.com/security/cve/cve-2023-0464
+[RHSA-2023:3722]: https://access.redhat.com/errata/RHSA-2023:3722
+[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/rocky.md

@@ -0,0 +1,70 @@
+# Rocky Linux
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
+
+## Vulnerability
+Rocky Linux offers its own security advisories, and these are utilized when scanning Rocky Linux for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+Trivy takes fixed versions from [Rocky Linux Errata][errata], not NVD or somewhere else.
+See [here](../../scanner/vulnerability.md#data-source-selection) for more details.
+
+!!! architectures
+    There are cases when the vulnerability affects packages of not all architectures.
+    For example, vulnerable packages for [CVE-2023-0361](https://errata.rockylinux.org/RLSA-2023:1141) are only `aarch64` packages.
+    
+    Trivy only detects vulnerabilities for packages of your architecture.
+
+### Severity
+Trivy calculates the severity of an issue based on the severity provided in [Rocky Linux Errata][errata].
+
+The table below is the mapping of Rocky Linux's severity to Trivy's severity levels.
+
+| Rocky Linux |  Trivy   |
+| :---------: | :------: |
+|     Low     |   Low    |
+|  Moderate   |  Medium  |
+|  Important  |   High   |
+|  Critical   | Critical |
+
+### Status
+Trivy supports the following [vulnerability statuses] for Rocky Linux.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[updateinfo]: https://download.rockylinux.org/pub/rocky/
+[errata]: https://errata.rockylinux.org/
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/suse.md

@@ -0,0 +1,40 @@
+# SUSE
+Trivy supports the following distributions:
+
+- openSUSE Leap
+- SUSE Enterprise Linux (SLE)
+
+Please see [here](index.md#supported-os) for supported versions.
+
+Trivy supports these scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|       Unfixed vulnerabilities        |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
+
+## Vulnerability
+SUSE offers its [own security advisories][cvrf], and these are utilized when scanning openSUSE/SLE for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+## License
+Trivy identifies licenses by examining the metadata of RPM packages.
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[cvrf]: http://ftp.suse.com/pub/projects/security/cvrf/
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/ubuntu.md

@@ -0,0 +1,65 @@
+# Ubuntu
+Trivy supports these scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+The following table provides an outline of the features Trivy offers.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|    Detect unfixed vulnerabilities    |     ✓     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Same as [Debian](debian.md#sbom).
+
+## Vulnerability
+Ubuntu offers its own security advisories, and these are utilized when scanning Ubuntu for vulnerabilities.
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+### Fixed Version
+When looking at fixed versions, it's crucial to consider the patches supplied by Ubuntu.
+As an illustration, for CVE-2023-3269, the fixed version for Ubuntu 23.04 (lunar) is listed as `6.2.0-26.26` in [the Security Tracker][CVE-2023-3269].
+It's essential to recognize that this differs from the upstream fixed version, which stands at `6.5`.
+Typically, only the upstream information gets listed on [NVD][CVE-2023-3269 NVD], so it's important not to get confused.
+
+### Severity
+Trivy calculates the severity of an issue based on the 'Priority' metric found in the Security Tracker.
+If 'Priority' isn't provided by Ubuntu, the severity from the NVD is taken into account.
+
+Using CVE-2019-15052 as an example, while it is rated as ["Critical" in NVD][CVE-2019-15052 NVD], Ubuntu has marked its "Priority" as ["Medium"][CVE-2019-15052].
+As a result, Trivy will display it as "Medium".
+
+### Status
+Trivy supports the following [vulnerability statuses] for Ubuntu.
+
+|       Status        | Supported |
+| :-----------------: | :-------: |
+|        Fixed        |     ✓     |
+|      Affected       |     ✓     |
+| Under Investigation |           |
+|    Will Not Fix     |           |
+|    Fix Deferred     |           |
+|     End of Life     |           |
+
+## License
+Same as [Debian](debian.md#license).
+
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[Ubuntu CVE Tracker]: https://ubuntu.com/security/cve
+
+[CVE-2023-3269]: https://ubuntu.com/security/CVE-2023-3269
+[CVE-2019-15052]: https://ubuntu.com/security/CVE-2019-15052
+[CVE-2023-3269 NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-3269
+[CVE-2019-15052 NVD]: https://nvd.nist.gov/vuln/detail/CVE-2019-15052
+
+[vulnerability statuses]: ../../configuration/filtering.md#by-status

docs/docs/coverage/os/wolfi.md

@@ -0,0 +1,31 @@
+# Wolfi Linux
+Trivy supports these scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     ✓     |
+|    License    |     ✓     |
+
+The table below outlines the features offered by Trivy.
+
+|               Feature                | Supported |
+|:------------------------------------:|:---------:|
+|    Detect unfixed vulnerabilities    |     -     |
+| [Dependency graph][dependency-graph] |     ✓     |
+
+## SBOM
+Same as [Alpine Linux](alpine.md#sbom).
+
+## Vulnerability
+Wolfi Linux offers its own security advisories, and these are utilized when scanning Wolfi for vulnerabilities.
+Everything else is the same as [Alpine Linux](alpine.md#vulnerability).
+
+### Data Source
+See [here](../../scanner/vulnerability.md#data-sources).
+
+## License
+Same as [Alpine Linux](alpine.md#license).
+
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+[secdb]: https://packages.wolfi.dev/os/security.json