Description

Hi,
I want to know you opinion about following use-case.

Let's have following use-case:

• Java/Kotlin application build with GraalVM AOT Native build (.jar libs are baked into executable)
• Application is distributed as Docker Image
• SBOM is generated and saved into for example Artifactory

If I understand correctly current behavior of Trivy:

• baked .jar libs are not scanned because Trivy does not know about them
• Only artifacts in Image itself are scanned
• There is no way how to tell Trivy to also use SBOM (I saw remote-sbom config, but it is something different - I guess)

What do you think?

Thx

Ivos

Target

Container Image

Scanner

Vulnerability