Trivy

• Category: sca + container
• Fingerprint: cve-package-version-v1 (dedupes with OSV-Scanner)
• License: Apache-2.0

Trivy covers OS packages, language dependencies, IaC misconfigs, and container images. Vetrix wires three of those surfaces:

• trivy fs for source-level SCA.
• trivy image for the container registry.
• Misconfigs are delegated to Checkov to avoid duplicate coverage.

When to enable

Any repo with an OS package list, a go.mod, package.json, requirements.txt, or equivalent. It is the default breadth scanner.

sca:
  enabled: true
  trivy: { enabled: true }

Common false positives

• CVE triggered by a transitive dep you have already patched → confirm the effective version with go mod why -m <pkg> and dismiss with a reason.
• CVEs without a fixed version → tag with state=detected but accept the backlog; Trivy re-fires until upstream publishes a patch.

Container image hardening

trivy image runs against every registry push. Image findings follow the same fingerprint scheme so an OS-level CVE reports once per (pkg, version) pair regardless of tag.