Align semantics of published_date of advisories b/w Trivy and GLAD

Problem to solve

In advisories exports of the Package Metadata DB, the meaning of the published_date field differs b/w the Trivy DB and GLAD.

  • For Trivy DB, published_date is when the advisory was published. See trivy/trivy.go and trivy/raw_advisory.go.
  • For GLAD, it is when the advisory was last updated. See date field of YAML files.

This discrepancy might lead to unexpected behaviors.

Proposal

  • Introduce a new field that indicates when the advisory was last updated.
  • Align export of Trivy DB advisories w/ export of GLAD advisories.
    • published_date is when the advisory was first published.
    • The new field indicates when the advisory was last updated.
  • Change the backend to trigger scans accordingly, so that it triggers scans for advisories recently updated.

/cc @nilieskou @adamcohen @ifrenkel

Assignee Loading
Time tracking Loading