Trivy: Is it good to depend on safety-db for Python vuln DB?

[chezou]

It seems safety-db isn't actively maintained, is it good for trivy to keep depending on safety-db to detect Python vulnerabilities?

[knqyf263]

Thank you for opening the issue! Actually, I've been looking for another public database for Python vulnerabilities, but I've never found it. For now, safety-db can be used for old vulnerabilities, so I'm going to keep it. If someone knows another database, let me know, please. I'd switch safety-db to it.

[chezou]

Not sure it is the right solution, I think GitHub Advisory Database can be an alternative. They only provide GraphQL API though.

[knqyf263]

I think they provide API to retrieve a result of Python vulnerabilities in GitHub repository. It means a user who doesn't use GitHub can't use the API. Or, do they have API to detect vulnerabilities of package information sent from a client?

[chezou]

GitHub Advisory Database provides vulnerability info of pip, RubyGems, etc, including CVE, which means I guess it is the source info of dependabot. You can look it on your browser https://github.com/advisories?query=ecosystem%3Apip and they also provides GraphQL API as well (see also https://gist.github.com/chezou/998c1bb19a6bb6f292ba5012d02d815a).

Of course, GitHub API requires GitHub account, if this requirement isn't suitable for trivy, we can't use it for safety-db alternate.

[knqyf263]

Oh, I didn't know it! I've thought it was provided only for GitHub repositories. Thanks!

Now, we build a vulnerability database in GitHub Actions and upload it to GitHub Release. https://github.com/aquasecurity/trivy-db/releases
I will ask GitHub if we can use GitHub Advisory Database for this purpose.

[chezou]

That should be great if we could bundle them into releases! I hope GitHub allows to use it for trivy 🤞

[knqyf263]

@lizrice found the license!
https://help.github.com/en/github/site-policy/github-additional-product-terms#11-advisory-database

[knqyf263]

@chezou Now, we're working on the replacement. You can track it #415. Thank you for the information.