Trivy

Overview

This installation happens on the dsb-hub.

According to Trivy's GitHub Repository, Trivy is a comprehensive, easy-to-use open-source vulnerability scanner. It detects vulnerabilities in OS packages, container images, file systems, and Git repositories. Additionally, Trivy can identify configuration issues and hard-coded secrets, making it an essential tool for DevSecOps practices. This guide will walk you through the steps to install and configure Trivy on your system.

Installation Steps

1. Configure and Install Package

• Install required packages and add the Trivy repository key:

  sudo apt-get install wget apt-transport-https gnupg
  wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null

• Add the Trivy repository to your sources list:

  echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list

• Update your package list and install Trivy:

  sudo apt-get update
  sudo apt-get install trivy

2. Check if Trivy is Installed Successfully

• Verify that Trivy is installed and running correctly by running the trivy command:

  trivy

• You should see output similar to the following, which confirms that Trivy is installed and provides usage instructions:

  Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets
  
  Usage:
    trivy [global flags] command [flags] target
    trivy [command]
  
  Examples:
    # Scan a container image
    $ trivy image python:3.4-alpine
  
    # Scan a container image from a tar archive
    $ trivy image --input ruby-3.1.tar
  
    # Scan local filesystem
    $ trivy fs .
  
    # Run in server mode
    $ trivy server
  
  Scanning Commands:
    config      Scan config files for misconfigurations
    filesystem  Scan local filesystem
    image       Scan a container image
    kubernetes  [EXPERIMENTAL] Scan kubernetes cluster
    repository  Scan a repository
    rootfs      Scan rootfs
    sbom        Scan SBOM for vulnerabilities and licenses
    vm          [EXPERIMENTAL] Scan a virtual machine image
  
  Management Commands:
    module      Manage modules
    plugin      Manage plugins
    vex         [EXPERIMENTAL] VEX utilities
  
  Utility Commands:
    clean       Remove cached files
    completion  Generate the autocompletion script for the specified shell
    convert     Convert Trivy JSON report into a different format
    help        Help about any command
    server      Server mode
    version     Print the version
  
  Flags:
        --cache-dir string          cache directory (default "/home/damien/.cache/trivy")
    -c, --config string             config path (default "trivy.yaml")
    -d, --debug                     debug mode
    -f, --format string             version format (json)
        --generate-default-config   write the default config to trivy-default.yaml
    -h, --help                      help for trivy
        --insecure                  allow insecure server connections
    -q, --quiet                     suppress progress bar and log output
        --timeout duration          timeout (default 5m0s)
    -v, --version                   show version

You're Done

Trivy is now installed and ready to be used for scanning vulnerabilities in container images, file systems, and more. With Trivy, you can ensure that your applications are secure and free from known vulnerabilities before deploying them to production.