EL10 support

[hairmare]

Description

I recently suggested adding EL10 support to the trivy-rpm repo: aquasecurity/trivy-repo#43

RHEL 10 was officially released in May 2025.

Have you considered adding it to this repo?

Your CONTRIBUTING.md seems to indicate that the next step is to raise this here so it can be added to

trivy/ci/deploy-rpm.sh

Line 43 in 36ab331

VERSIONS=(5 6 7 8 9)

as suggested by @knqyf263.

After some searching for related discussions, i only found #9679 which relates to scanning EL10, not providing binaries for EL10. It looks like i'm the first one to ask for running trivy on EL10 (vs. having it scan EL10 targets reliably).

I'll gladly add a 10 to the CI script, can you let me know what the next steps to do so would be? If you could share some info on the bigger picture of EL10 suppoert, that would also be appreciated.

Thank you very much!

Target

None

Scanner

None

[DmitriyLewen]

Hello @hairmare,

Although the changes required to support RHEL 10 are minimal (basically just adding “10” to the script),
testing them takes some time.

To verify these changes, you’ll need to:

Preparation:

1. Fork the trivy-repo.
2. Fork the trivy repository.
3. Remove unnecessary steps and settings (for example, login and push to the registry).
   Here’s how I did it:
   • Goreleaser: example
   • Release workflow:
   • example - workflow file
   • You can also remove steps that push .deb files to avoid adding GPG keys (although I’m not sure if goreleaser will complain about an empty GPG_KEY env).
4. Make the changes in the deploy-rpm.sh script.
5. Push a new tag to trigger the release process.

If there are any errors — fix them (and if you can’t figure them out, feel free to message me — I’ll help).
If everything works — try installing Trivy from your fork.

Finally, attach the following to the new PR (with your script changes):
• the release run,
• links to the new files for RHEL 10,
• and your confirmation that everything works.

[gwitsch]

Joining this discussion for current status.

I've updated all our containers to RHEL 10 and I don't think that Trivy is working correctly.

We had about 72 issues with RHEL 9.6.
Now just 5 are found. Just Java packages no Linux ones.

I highly doubt that Red Hat fixed all vulnerable packages XD

By the way we use ubi-minimal:10.0 as our base image.

The only thing I found in the release notes for version 0.64.0 is

redhat: Add EOL date for RHEL 10. (#8910) (48258a7)

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0640-2025-06-30

[DmitriyLewen]

hello @gwitsch
Related issue - #7452 (comment)