feat(minimos): Add support for MinimOS

[Daniel-Wachter]

Hi,
I’m part of the Minimus team. Minimus delivers secure, minimal container images with auto-generated SBOMs and real-time vulnerability threat intelligence to help reduce vulnerability risk.
We also maintain a minimal operating system called MinimOS. We’ve been publishing our security advisories in a secdb feed and would like to contribute it as a new security data source.

Details:
The feed URL: https://packages.mini.dev/advisories/secdb/security.json

The format closely mirrors Alpine's secdb, but it's unversioned—similar to Alpine's edge feed.

Discussion ref: aquasecurity/trivy#8666

Thanks for your consideration!

[DmitriyLewen]

LGTM.

Left small comments

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull Request Overview

This PR adds support for MinimOS as a new security data source by implementing a new vulnerability source. Key changes include registering MinimOS in the main vulnerability source registry, defining a new constant for MinimOS, and introducing a dedicated package with tests and sample JSON data for MinimOS.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

File	Description
pkg/vulnsrc/vulnsrc.go	Registers the new MinimOS vulnerability source by adding the appropriate import and registration in the list of vulnerability sources.
pkg/vulnsrc/vulnerability/const.go	Adds the MinimOS constant to the list of known source IDs.
pkg/vulnsrc/minimos/ (minimos.go, minimos_test.go, JSON files)	Implements the vulnerability source logic, tests, and test data for MinimOS.

Comments suppressed due to low confidence (1)

pkg/vulnsrc/minimos/minimos_test.go:53

• [nitpick] It might be beneficial to add additional cases to cover different error scenarios during JSON decoding for improved test coverage.

wantErr: "json decode error",

[DmitriyLewen]

@Daniel-Wachter I have 1 question:
When version in secfixes is 0 - does that mean the vulnerability is fixed in all versions?

e.g.:

  "packages": [
    {
      "pkg": {
        "name": "apache2",
        "secfixes": {
          "0": [
            "CVE-1999-0289",
            "CVE-1999-0678",
            "CVE-1999-1237",

[Daniel-Wachter]

@DmitriyLewen yes, it means the CVE is not relevant to our package and so fixed in all versions

[DmitriyLewen]

Thanks for confirming.
This means we can skip (not include) vulnerabilities with the fixed version 0 for trivy-db.

Changed in 257b873

cc. @knqyf263

[DmitriyLewen]

I confirm that trivy-db built using new vuln-list contains advisories for MinimOS: