Trivy: Non-commercial vs commercial usage: which data sources?

Created on 13 May 2020 · 3Comments · Source: aquasecurity/trivy

The README says some of the data sources are only licensed for non-commercial usage. It's difficult for me as a potential user to tell whether I can or cannot use trivy in a particular scenario.

It would be useful to have:

A flag that disables sources that are non-commercial-use-only.
Documentation of which sources are non-commercial-use-only, and the impact of the flag if it's implemented.

Thank you!

triagsupport

Source

itamarst

👍10

Most helpful comment

It makes sense. In fact, we're now considering the option. As for ruby-advisory-db, it includes some data from OSVDB which doesn't allow commercial usage. Now, we're trying to remove those data to make it a commercial friendly data source.
https://github.com/rubysec/ruby-advisory-db/pull/456

After this PR gets merged, we can add the option.

knqyf263 on 30 Sep 2020

👍3

All 3 comments

👋 Just a Trivy fan here. That's a great point!

These are the data source licenses I managed to collect so far:

Language Specific Data Sources (https://github.com/aquasecurity/trivy#data-sources):

OS Data Sources (https://github.com/aquasecurity/vuln-list):

❓ Alpine Linux Bug Tracker
❓ Amazon Linux Security Center
❓ Amazon Linux Security Center 2
❓ Debian Security Bug Tracker
❓ National Vulnerability Database
❓ Debian GNU/Linux OVAL
✅ Security Data - Creative Commons Attribution 4.0 license
❓ Ubuntu CVE Tracker
❓ OpenSUSE/SLES SUSE Security CVRF
❓ Photon Security Advisory

Now regarding a flag for using only commercial friendly data sources, I think the change has to first happen at trivy-db since that's where the database file Trivy fetches is compiled every 12 hours.

kgeorgiou on 10 Jul 2020

It would be definitely useful to have this option, especially as there are additional data sources used by Trivy (for example the Github Advisory Database used by pkg/vulnsrc/ghsa/ghsa.go (referenced by pkg/vulnsrc/vulnsrc.go)).
Those are seem to licensed under the Creative Commons Attribution 4.0 license (https://docs.github.com/en/github/site-policy/github-additional-product-terms#12-advisory-database) but this doesn't mean that an other data source wouldn't be added to the repo later on (with a license that's not for commercial use)