使用 Homebrew, apk, chocolatey, dnf, MacPorts, Nix, pacman, zypper, scoop, winget 安装 trivy

项目链接

• 主页
• 仓库
• 上游文档
• 软件包管理器页面

命令和别名

• trivy

项目历史

Aqua's official blog announced on August 19, 2019 that Trivy, described there as a popular open-source container image vulnerability scanner, had joined the Aqua open-source family. The current project README shows how the scope expanded: Trivy now has multiple target types and scanners, including vulnerabilities, SBOM/package inventory, IaC misconfiguration, secrets, and license scanning.

That expansion mirrors the wider cloud-native security shift from image scanning as a point task to supply-chain and runtime-adjacent checks in CI, repositories, Kubernetes clusters, and local filesystems. Trivy's own docs and README frame it as a single CLI front end for those related checks rather than a collection of separate tools.

采用历史

The official homepage calls Trivy the most popular open-source security scanner for vulnerability scanning, IaC, SBOM discovery, cloud scanning, and Kubernetes security. The README lists integrations with GitHub Actions, the Trivy Kubernetes operator, and a VS Code extension, while the installation docs distinguish official and community install channels.

Homebrew adoption fits the way Trivy is commonly used: installed as a local CLI for developers and CI authors, run in Docker for pipeline isolation, and embedded into GitHub Actions or Kubernetes workflows for continuous scanning. Its package-manager presence is not ornamental; the package is a common entry point for trying a scanner before wiring it into automation.

使用方式

The README's general pattern is `trivy <target> [--scanners <scanner1,scanner2>] <subject>`. Examples include `trivy image python:3.4-alpine`, filesystem scans such as `trivy fs --scanners vuln,secret,misconfig myproject/`, and Kubernetes scans such as `trivy k8s --report summary cluster`.

In the package-nerd niche, Trivy is often used to inspect what a package, container image, repository, lockfile, or cluster would expose to a vulnerability database or policy scanner. The same executable can produce quick local answers and also serve as the scanner behind CI jobs, image-registry checks, and Kubernetes security reports.

为什么软件包爱好者会关心

Trivy is significant because it connects package metadata to security outcomes. It reads OS packages and language dependencies, maps them to CVEs and other findings, and can emit SBOM-centered views. For people who track package ecosystems, it is both a user-facing CLI and a packaging/data-source stress test across distros, language lockfiles, images, and repositories.

It is also a good example of a security CLI becoming infrastructure: package managers install it, CI systems wrap it, Kubernetes operators schedule it, and downstream tools consume its reports. That makes its history more important than a normal formula entry.

时间线

• 2019-08-19: Aqua announced that Trivy had joined the Aqua open-source family.
• Current README: Trivy documents targets including container images, filesystems, Git repositories, VM images, and Kubernetes.
• Current README: Trivy documents scanners for vulnerabilities, SBOM/package inventory, IaC misconfiguration, secrets, and licenses.
• Current docs: Installation documentation covers official and community channels and points users to CI/CD, IDE, Kubernetes, and other integrations.

Related projects

• Aqua Security, Trivy DB, Trivy Operator, trivy-action, Harbor scanner integrations, Kubernetes, SBOM tooling

来源

• https://github.com/aquasecurity/trivy#readme
• https://trivy.dev/
• https://trivy.dev/docs/latest/getting-started/installation/
• https://www.aquasec.com/blog/trivy-vulnerability-scanner-joins-aqua-family/