Add support for LoongArch binaries in Trivy.

[yzewei]

Description

LOONGARCH is a RISC-based CPU architecture increasingly adopted in server, cloud, and edge computing environments.

Many open-source projects and container images now provide LoongArch builds. Alpine 3.22 already supports it, and Debian support is coming soon.

Users deploying production workloads on LoongArch platforms require accurate binary and image scanning. However, Trivy currently does not support official LoongArch binaries.

Impact

This would improve Trivy’s applicability across a broader range of architectures, enhancing its value to the community. LoongArch is already used by millions of people, and native support in tools like Trivy would allow even more users to benefit. Thank you very much!

Target

Git Repository

Scanner

None

[yzewei]

@shift @ocean @tudorst so thanks!

[knqyf263]

I don’t think releasing binaries for LoongArch would be difficult, but due to limitations such as the storage capacity of GitHub Actions, we can’t just build everything. How much demand is there? For example, how is it handled in other OSS projects?

[yzewei]

Thanks for raising this, @knqyf263.

I understand the concerns regarding GitHub Actions storage limits and the need to prioritize builds.

Regarding demand: in China, many developers and organizations need security scanning tools but often lack official access. Providing LoongArch binaries, even as experimental builds, could help meet this demand and allow more developers to test and report issues across different architectures, improving Trivy for all platforms.

As a practical approach, we could follow what other OSS projects have done. For example, Telegraf
provides nightly builds for LoongArch. This shows we can start with community-supported or experimental builds, and gradually move toward official releases as CI/infrastructure becomes available.

[ocean]

A quick search shows about 530 matches for GOARCH=loong64 across GitHub, and about 220 pull requests mentioning this string. Agreed @knqyf263 that releasing Go binaries for LoongArch would likely be fairly straightforward, however there would be no automated testing on this architecture of course @yzewei - unless you have resources available for this?

It might be that Trivy would be the first security scanning related project to be ported to Loong64 architecture. Would that be an exciting thing maybe?

[knqyf263]

Considering that arm64 has 36.4 matches, I still feel it has not yet become widespread. Also, regarding PRs, it seems that most of them only mention loong64 within Dependabot commit messages. And as Cloudflare mentioned, at present, we have no infra to test loong64, so I feel it is difficult.

[yzewei]

Thanks @ocean and @knqyf263 for the comments.

I fully understand the concerns about LoongArch adoption and the lack of CI infrastructure. It’s true that usage is not yet comparable to arm64, and without automated testing it’s hard to guarantee stability.

That said, there could still be significant value in providing unofficial or experimental binaries for LoongArch. In China, there are many users who need security scanning tools but often lack official access to them. If Trivy supports LoongArch, it could enable more developers to test and provide feedback across different architectures, potentially uncovering more architecture-specific or general issues.

As a compromise, maybe we could:

Start with community-provided LoongArch builds (marked as “experimental, not officially tested”).

Revisit official release integration once we (or the wider community) have access to LoongArch runners/infra for CI.

I’d be happy to help provide builds or testing resources if that helps move things forward.

[yzewei]

Thanks @ocean and @knqyf263.

I understand the concerns about LoongArch adoption and lack of CI.

As a solution, we could start with experimental LoongArch builds and use QEMU to emulate both major LoongArch versions for basic automated testing. This would allow early feedback and testing without needing physical hardware.

I’m happy to take on this work, including but not limited to LoongArch CI, automated testing, and contributing to other Trivy community issues.