DependencyTrack / DependencyTrack/dependency-track

Custom vuln feeds support

Open
#5,642 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Good afternoon. We use the ALT Linux distribution, which is not officially supported by Trivy. The distribution vendor independently enriches the Trivy databases with information about its packages and publishes them in its own Docker registry. When using these databases, we obtain a complete vulnerability report for images based on ALT Linux. I deployed a Trivy server that uses the customized vulnerability databases and configured it in the Dependency-Track analyzer settings, but no vulnerabilities are found when analyzing an SBOM.

Custom trivy-DB - docker pull registry.altlinux.org/alt/trivy-db:latest

[report.html](https://github.com/user-attachments/files/24250399/report.html)

### Proposed Behavior

When custom databases are specified, Dependency-Track detects all vulnerabilities in the ALT Linux image.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.