maven plugin to run trivy

[netodevel]

Hello,
I'm thinking of creating a maven plugin to run trivy under the hood, as the trivy project is apache license 2.0 I would like to know if "third parties" are allowed to create plugins.

[itaysk]

Hi, feel free to create anything with Trivy (please mention clearly that it's powered by Trivy). If you'd like to showcase your work you can post it as a Show and Tell discussion and if it's relevant you can also send a PR to add it to the Ecosystem section in the documentation.

[netodevel]

Thanks for the answer,
As soon as I have a release I will share it on the Trivy ecosystem.

[sbernard31]

@netodevel do you move forward on this ?

[sbernard31]

It seems you do : #4174

[sbernard31]

But not exactly what I had in mind 😅 (it seems your project is focused on scanning docker image)

I was thinking this could have been a way to search vulnerability of a given maven project. a bit like https://github.com/jenkinsci/dependency-check-plugin