ALT Linux distribution support for trivy system.

[Alex619829]

Description

Hello!
I would like to add support for the ALT distribution to trivi.
For this, I suggest pull requests to several of your repositories, as well as adding another new repository containing a list of vulnerabilities for the ALT distribution.

🔗 Repository with ALT vulnerabilities: [https://github.com/Alex619829/vuln-list-alt]

---

⛓️ Related Upstream Pull Requests

In addition, I have contributed related work to the following upstream repositories:

1. [PR link 1] – [PR to trivy]
2. [PR link 2] – [PR to trivy-db]
3. [PR link 3] – [PR to vuln-list-update]

Target

Container Image

Scanner

Vulnerability

[DmitriyLewen]

Hello @Alex619829
Thanks for your work!

Is this some repository with vulnerability information (I mean something like https://ubuntu.com/security/cves or https://security.alpinelinux.org/)?
We need to redirect users to some repository with vulnerability information in human-readable format (since working with OVAL is inconvenient for users).

also, Trivy repository has been growing bigger and bigger lately.
So it's getting harder to maintain.
So let's wait a little to understand how much this functionality is needed by users

[Alex619829]

The list of vulnerabilities of the ALT distribution is formed from information about vulnerabilities from two sources:

🔹 https://errata.altlinux.org/

• This is the official website of ALT Linux Errata — a list of updates, fixes, and vulnerabilities found in ALT Linux distributions.
• ALT Linux is a Russian GNU/Linux distribution.
• This site publishes messages about package updates, vulnerability fixes, and other changes in the distribution.
• In essence, this is a vulnerability and update notification system similar to what other distributions have (for example, Fedora or Ubuntu).

🔹 https://bdu.fstec.ru/vul/

• This is a section of the Vulnerability Database on the website of the FSTEC of Russia (Federal Service for Technical and Export Control).
• This contains a state registry of vulnerabilities identified in software.
• It is used as part of a comprehensive information security system in Russia.
• Each vulnerability has a unique identifier (for example, UBI.12345) and is accompanied by a description, danger level, and recommendations for elimination.
• This is an analogue of international databases such as CVE (Common Vulnerabilities and Exposures), but with a focus on Russian realities and regulations.

[Alex619829]

Hello! This distribution is widely used in my country, and we have been supporting this distribution's image scanning functionality for a long time.
We already made a Pull Request 2 years ago asking to add our distribution:
aquasecurity/vuln-list-update#208
Our distribution's users actively use this functionality so we will support this.

[DmitriyLewen]

Hello @Alex619829
Sorry for delay.

I wanted to check https://errata.altlinux.org/, but see Bad Gateway.
Do you have some info about that?