Align semantics of published_date of advisories b/w Trivy and GLAD
Problem to solve
In advisories exports of the Package Metadata DB, the meaning of the published_date field differs b/w the Trivy DB and GLAD.
- For Trivy DB,
published_dateis when the advisory was published. See trivy/trivy.go and trivy/raw_advisory.go. - For GLAD, it is when the advisory was last updated. See
datefield of YAML files.
This discrepancy might lead to unexpected behaviors.
Proposal
- Introduce a new field that indicates when the advisory was last updated.
- Align export of Trivy DB advisories w/ export of GLAD advisories.
-
published_dateis when the advisory was first published. - The new field indicates when the advisory was last updated.
-
- Change the backend to trigger scans accordingly, so that it triggers scans for advisories recently updated.