feat(rocky): Add Rootio Rocky Support by urimils · Pull Request #557 · aquasecurity/trivy-db

urimils · 2025-07-20T08:17:19Z

Add support for Rocky in Root.io flow.
Since Rocky uses Arch as well as os and pkg versions, added an adapter so both options can be used where "Get" is required

CLAassistant · 2025-07-20T08:17:25Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ chait-slim
❌ Uri

Uri seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

DmitriyLewen

hello @urimils
I left a comments.

Also i don't see Rocky advisories in feed.

DmitriyLewen · 2025-07-21T05:47:48Z

pkg/db/db.go

 	Get(string, string) ([]types.Advisory, error)
 }

+type TrioGetter interface {


I think that we can create one common interface for all (except RedHat) sources.
i created #558

After these changes we will easy use any source for root.io

@knqyf263 wdyt?

Thats exactly the rational behind this part of the PR - the differences between the two argument and three argument getters (otherwise it would of been a very simple addition). Do you want me to rebase above the #558 branch?

Do you want me to rebase above the #558 branch?

No need this. You will rebase main branch after merge #558

Ok, so I will wait for the merge there before updating this PR (I just wanted to be proactive)

For now you can edit other comments :)

@chait-slim we merged #558

DmitriyLewen · 2025-07-21T05:49:23Z

pkg/vulnsrc/rootio/rootio_test.go

 			args: args{
 				osVer:   "11",
 				pkgName: "openssl",
+				arch:    "amd64",


this change can confusing (debian advisories don't use arches).
So let's add arch only for rocky related advisories.

chait-slim · 2025-07-21T07:04:04Z

@DmitriyLewen

Also i don't see Rocky advisories in feed.

Rocky feeds will be added on our side very shortly (matter of a week or two) with exactly the same format as Debian and Ubuntu. We our opening this PR now to allow Trivy to catch these on the July release

DmitriyLewen · 2025-07-21T07:39:08Z

We our opening this PR now to allow Trivy to catch these on the July release

thank you for trying to prepare PRs in advance!

Rocky feeds will be added on our side very shortly (matter of a week or two) with exactly the same format as Debian and Ubuntu

You need to add rocky advisories into testfile.
We always build trivy-db with new data before merge PR. It would also be strange if we merge PR for Trivy (which states that Trivy supports Rocky for root.io), but trivy-db still doesn't have these advisories. So we will only merge PRs after adding a recommendation for Rocky.

chait-slim · 2025-07-21T07:41:33Z

We our opening this PR now to allow Trivy to catch these on the July release

thank you for trying to prepare PRs in advance!

Rocky feeds will be added on our side very shortly (matter of a week or two) with exactly the same format as Debian and Ubuntu

You need to add rocky advisories into testfile.

We always build trivy-db with new data before merge PR. It would also be strange if we merge PR for Trivy (which states that Trivy supports Rocky for root.io), but trivy-db still doesn't have these advisories. So we will only merge PRs after adding a recommendation for Rocky.

Will update the file. Thanks!

DmitriyLewen · 2025-07-22T04:12:42Z

pkg/vulnsrc/rootio/testdata/happy/vuln-list/rootio/cve_feed.json

+        {
+          "pkg": {
+            "name": "nginx",
+            "cves": {


Will there be architectures in the root.io feed?
I think we can't use Rocky's arches because:

There is a case where Rocky's advisory doesn't contain a CVE, but root.io has a fix for that CVE.

There seems to be a case where root.io and Rocky advisories contain different architectures.

From our point of view archs don't really matter:

A vulnerability is relevant for both archs and we create fixes for both

A vulnerability is only relevant for one arch and we create a fix for it

let's see the following example:
There are CVE-2000-0001 for pkgA (affected versions are > 0.0.1 < 0.0.5) for amd64 only.
You create fix for this CVE and add it into feed (vulnerable_ranges is > 0.0.1 < 0.0.5-root.io.1)

User scans pkgA@0.0.2 for aarch64.
We find that feed contains CVE-2000-0001 for this package and show this package as vulnerable.
This is false positive.

I see two options here:

I add arch per cve for rocky

There can be logic that checks - if no advisory from redhat, dont add the root vulnerability

I add arch per cve for rocky

You mean in root.io feed, right?
I think this is best solution.

in this case advisories will be "transparent" for users.
User will clearly see vulnerable version, patched version and architecture.
User will not need to refer to other advisory source, etc.

Ok, after discussing internally, I will update the feed for all cves with the archs (to make the feed consistent). From Trivy's pov there shouldn't be any change - the arch will be ignored for Debian, Ubuntu, Alpine and used for Rocky,

we only need arches for Rocky.
The rest of distrs are at your discretion.

BTW changes will be required in vuln-list-update
we did not specify the arch in schema:
https://github.com/aquasecurity/vuln-list-update/blob/be8391dd6bbdc696d65fd50adeb629aabde0a206/rootio/types.go#L23-L27

Thanks, will update

chait-slim · 2025-07-23T13:00:05Z

@DmitriyLewen Rebased

DmitriyLewen · 2025-07-24T04:13:02Z

pkg/vulnsrc/amazon/amazon_test.go

 	"path/filepath"
 	"testing"

-	"github.com/aquasecurity/trivy-db/pkg/db"


We use this import:

trivy-db/pkg/vulnsrc/amazon/amazon_test.go

Line 155 in a897efc

GetParams: db.GetParams{

DmitriyLewen · 2025-07-24T04:13:12Z

pkg/vulnsrc/azure/azure_test.go

 	"path/filepath"
 	"testing"

-	"github.com/aquasecurity/trivy-db/pkg/db"


DmitriyLewen · 2025-07-24T04:13:16Z

pkg/vulnsrc/debian/debian_test.go

 	"path/filepath"
 	"testing"

-	"github.com/aquasecurity/trivy-db/pkg/db"


DmitriyLewen · 2025-07-24T04:13:22Z

pkg/vulnsrc/echo/echo_test.go

 	"path/filepath"
 	"testing"

-	"github.com/aquasecurity/trivy-db/pkg/db"


DmitriyLewen · 2025-07-24T04:18:19Z

pkg/vulnsrc/photon/photon_test.go

 package photon

 import (
+	"github.com/aquasecurity/trivy-db/pkg/db"


it will be linter error

DmitriyLewen · 2025-07-24T04:24:50Z

pkg/vulnsrc/rootio/testdata/fixtures/happy.yaml

+- bucket: rocky 9
+  pairs:
+    - bucket: openssl
+      pairs:
+        - key: CVE-2023-0464
+          value:
+            FixedVersion: ""
+            Status: 2
+        - key: CVE-2024-13176
+          value:
+            FixedVersion: ""
+            Status: 2


IIRC rocky always contains arch.
Tell me if you know CVEs without arch

DmitriyLewen · 2025-07-24T04:25:24Z

pkg/vulnsrc/rootio/testdata/fixtures/happy.yaml

+- bucket: root.io rocky 8
+  pairs:
+    - bucket: openssl
+      pairs:
+        - key: CVE-2023-0464
+          value:
+            VulnerableVersions:
+              - "<1.1.1k-7.el8_6.root.io.1"
+            PatchedVersions:
+              - "1.1.1k-7.el8_6.root.io.1"
+        - key: CVE-2024-13176
+          value:
+            VulnerableVersions:
+              - "<3.0.7-1.el8.root.io.2"
+            PatchedVersions:
+              - "3.0.7-1.el8.root.io.2"


As we discussed before - root.io advisories will contain arches.
Add arches here.

DmitriyLewen · 2025-07-24T04:25:45Z

pkg/vulnsrc/suse-cvrf/suse-cvrf_test.go


 	"github.com/stretchr/testify/assert"

-	"github.com/aquasecurity/trivy-db/pkg/db"


as for amazon_test.go

DmitriyLewen · 2025-07-24T04:26:03Z

pkg/vulnsrc/rootio/rootio_test.go

let's add testcase for Update function

DmitriyLewen · 2025-07-24T04:27:29Z

pkg/vulnsrc/rootio/rootio.go

We need to add filter be arch in Get function.
example from Rocky:

trivy-db/pkg/vulnsrc/rocky/rocky.go

Lines 296 to 298 in 56ec1e4

if !slices.Contains(entry.Arches, params.Arch) {

continue

}

…o-rocky-support Resolved merge conflicts by accepting upstream changes that use db.GetParams interface instead of individual parameters in Get methods. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

DmitriyLewen · 2025-09-18T07:30:39Z

Hello @chait-slim,
Is there any news about Rocky?
It looks like the feed still doesn’t contain Rocky advisories.

Uri added 2 commits July 20, 2025 11:14

init

3c837a0

update used interface and create relevant adapter

24f0f92

urimils changed the title ~~Rootio rocky support~~ Rootio Rocky Support Jul 20, 2025

urimils marked this pull request as ready for review July 20, 2025 09:57

urimils requested a review from knqyf263 as a code owner July 20, 2025 09:57

urimils mentioned this pull request Jul 20, 2025

feat(rocky): Add Rootio Rocky Support aquasecurity/trivy#9225

Open

7 tasks

urimils changed the title ~~Rootio Rocky Support~~ feat(rocky): Add Rootio Rocky Support Jul 20, 2025

DmitriyLewen reviewed Jul 21, 2025

View reviewed changes

chait-slim force-pushed the rootio-rocky-support branch 2 times, most recently from f40ec08 to 892f5bc Compare July 21, 2025 12:15

DmitriyLewen reviewed Jul 22, 2025

View reviewed changes

Uri and others added 5 commits July 23, 2025 15:28

init

97573ec

update used interface and create relevant adapter

71ef8f2

PR fixes

28f1860

remove impl of TrioGetter

9bb3ae6

rebase

a897efc

chait-slim force-pushed the rootio-rocky-support branch from 892f5bc to a897efc Compare July 23, 2025 12:53

DmitriyLewen reviewed Jul 24, 2025

View reviewed changes

Uri and others added 4 commits July 24, 2025 13:07

revert to main

2de1334

missed one

08c586f

add arch

ce6f51d


		"github.com/stretchr/testify/assert"

		"github.com/aquasecurity/trivy-db/pkg/db"

Conversation

urimils commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DmitriyLewen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chait-slim commented Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DmitriyLewen commented Jul 21, 2025

Uh oh!

chait-slim commented Jul 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chait-slim Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chait-slim commented Jul 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen commented Sep 18, 2025

Uh oh!

Reviewers

urimils commented Jul 20, 2025 •

edited

Loading

CLAassistant commented Jul 20, 2025 •

edited

Loading

chait-slim commented Jul 21, 2025 •

edited

Loading

chait-slim Jul 22, 2025 •

edited

Loading

DmitriyLewen Jul 22, 2025 •

edited

Loading

DmitriyLewen Jul 22, 2025 •

edited

Loading