DependencyTrack / DependencyTrack/dependency-track

Upcoming Trivy integration is awesome, but a bit slow

Open
#3,570 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Hey! We're really looking forward to the Trivy support added in 4.11.x so we've been testing out the snapshot. We've noticed some poor performance when scanning sboms with larger numbers of components (~600+), in some cases the scan can take 10 minutes. The trivy scan itself only takes a few seconds to return a result.

It's understood that this functionality is unreleased, but I'm keen to take a run at improving it 👍

Thanks again everyone, really great project.

### Steps to Reproduce

1. Enable Trivy integration using 4.11.0-SNAPSHOT
2. Start an analysis
3. Make coffee
4. Get results

### Expected Behavior

Repro steps minus step 3 🙂

It would be nice to reduce the scan time as much as possible to facilitate blocking CICD pipelines.

### Dependency-Track Version

4.11.0-SNAPSHOT

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

15.4

### Browser

N/A

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.