Ability to override OVAL content loading

[ArtemViacheslavovich]

Description

Trivy supports scanning OC fs, and it uses content from online resources as a data source. The table is here: https://trivy.dev/v0.46/docs/scanner/vulnerability/#data-sources. But what if Trivy operates in a closed environment without internet access? I can set up a proxy repository and a mirror to an online data source, but how can I reconfigure Trivy so it looks at my proxy instead of the internet?

Target

Filesystem

Scanner

Vulnerability

[knqyf263]

This page might help.
https://trivy.dev/latest/docs/advanced/self-hosting/

[ArtemViacheslavovich]

This article talks about configuring trivy databases.
And I asked a question regarding the OVAL content of the OS.
How can I override, for example, the loading of OVAL files for RHEL/CentOS, by default it will go here https://security.access.redhat.com/data/metrics/ to download them, and I need, for example: https://main.nexus.local/redhat-oval.

Is it possible to implement this using an additional flag when starting trivy or in trivy.yaml?

[knqyf263]

The database is built on GitHub Actions. Trivy just downloads the pre-built database.
There is no flag to configure OVAL locations to fetch, but you can modify trivy-db and build your own database as needed.