feat(redhat): Add EOL date for RHEL 10. #8910

Romain-Geissler-1A · 2025-05-23T23:34:18Z

Description

This adds RHEL 10 support that Red Hat has officially released this week at the Red Hat summit.

These before/after were tested with the image registry.access.redhat.com/ubi10/ubi:latest:

Before:

2025-05-23T23:18:58Z    INFO    Detected OS     family="redhat" version="10.0"
2025-05-23T23:18:58Z    WARN    This OS version is not on the EOL list  family="redhat" version="10"
2025-05-23T23:18:58Z    INFO    [redhat] Detecting RHEL/CentOS vulnerabilities...       os_version="10" pkg_num=172

After:

2025-05-23T23:20:24Z    INFO    Detected OS     family="redhat" version="10.0"
2025-05-23T23:20:24Z    INFO    [redhat] Detecting RHEL/CentOS vulnerabilities...       os_version="10" pkg_num=172

Also, I tested this with more complex RHEL 10 images we have started to build internally in Amadeus (actually any image that is built from registry.access.redhat.com/ubi10/ubi:latest in which we dnf install -y anything, for example procps, will do). Before it used to fail with errors like:

2025-05-23T23:32:10Z    INFO    Detected OS     family="redhat" version="10.0"
2025-05-23T23:32:10Z    WARN    This OS version is not on the EOL list  family="redhat" version="10"
2025-05-23T23:32:10Z    INFO    [redhat] Detecting RHEL/CentOS vulnerabilities...       os_version="10" pkg_num=173
2025-05-23T23:32:10Z    FATAL   Fatal error
  - run error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /remote/users/rgeissler/wk/tmp/trivy/pkg/commands/artifact/run.go:386
  - image scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.run
        /remote/users/rgeissler/wk/tmp/trivy/pkg/commands/artifact/run.go:424
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /remote/users/rgeissler/wk/tmp/trivy/pkg/commands/artifact/run.go:263
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /remote/users/rgeissler/wk/tmp/trivy/pkg/commands/artifact/run.go:653
  - scan failed:
    github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact 
        /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/service.go:177
  - failed to detect vulnerabilities:
    github.com/aquasecurity/trivy/pkg/scan/local.Service.ScanTarget
        /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/local/service.go:137
  - unable to scan OS packages:
    github.com/aquasecurity/trivy/pkg/scan/local.Service.scanVulnerabilities
        /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/local/service.go:187
  - failed vulnerability detection of OS packages:
    github.com/aquasecurity/trivy/pkg/scan/ospkg.(*scanner).Scan
        /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/ospkg/scan.go:57
  - failed detection:
    github.com/aquasecurity/trivy/pkg/detector/ospkg.Detect
        /remote/users/rgeissler/wk/tmp/trivy/pkg/detector/ospkg/detect.go:85
  - redhat vulnerability detection error:
    github.com/aquasecurity/trivy/pkg/detector/ospkg/redhat.(*Scanner).Detect
        /remote/users/rgeissler/wk/tmp/trivy/pkg/detector/ospkg/redhat/redhat.go:94
  - failed to get Red Hat advisories:
    github.com/aquasecurity/trivy/pkg/detector/ospkg/redhat.(*Scanner).detect
        /remote/users/rgeissler/wk/tmp/trivy/pkg/detector/ospkg/redhat/redhat.go:119
  - Oops: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
    Time: 2025-05-23 23:32:10.952595377 +0000 UTC
    Domain: redhat
    Tags: oval
    Trace: 01JVZQTT2VQ970CXEMCBXKJKJB
    Context:
      * package_name: procps-ng
      * repositories: []
      * nvrs: []
    Stacktrace:
      Oops: unable to find CPE indices. See https://github.com/aquasecurity/trivy-db/issues/435 for details
        --- at /remote/users/rgeissler/wk/go-build-artefacts/pkg/mod/github.com/aquasecurity/trivy-db@v0.0.0-20250227071930-8bd8a9b89e2d/pkg/vulnsrc/redhat-oval/redhat-oval.go:265 VulnSrc.Get()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/detector/ospkg/redhat/redhat.go:117 Scanner.detect()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/detector/ospkg/redhat/redhat.go:92 Scanner.Detect()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/detector/ospkg/detect.go:83 Detect()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/ospkg/scan.go:53 scanner.Scan()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/local/service.go:182 Service.scanVulnerabilities()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/local/service.go:135 Service.ScanTarget()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/local/service.go:112 Service.Scan()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/scan/service.go:175 Service.ScanArtifact()
        --- at /remote/users/rgeissler/wk/tmp/trivy/pkg/commands/artifact/run.go:651 runner.scan()

and after it can scan such images without problem:

2025-05-23T23:33:13Z    INFO    Detected OS     family="redhat" version="10.0"
2025-05-23T23:33:13Z    INFO    [redhat] Detecting RHEL/CentOS vulnerabilities...       os_version="10" pkg_num=173
2025-05-23T23:33:14Z    INFO    Number of language-specific files       num=0
2025-05-23T23:33:14Z    DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-05-23T23:33:14Z    DEBUG   [vex] VEX filtering is disabled

Report Summary

┌────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┬─────────┐
│                                     Target                                     │  Type  │ Vulnerabilities │ Secrets │
├────────────────────────────────────────────────────────────────────────────────┼────────┼─────────────────┼─────────┤
│ cc04e97c33c8a9508dcac9ab5d7ddfc6451f94667cc86b5e9278ae1b57b5445e (redhat 10.0) │ redhat │        0        │    -    │
└────────────────────────────────────────────────────────────────────────────────┴────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

CLAassistant · 2025-05-23T23:34:23Z

All committers have signed the CLA.

CLAassistant · 2025-05-23T23:34:23Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

DmitriyLewen

@Romain-Geissler-1A
Thanks for your contribution!

Can you sign CLA (#8910 (comment))?

Romain-Geissler-1A · 2025-05-26T08:17:49Z

Yes I will do later today. I am contributing this as part of my company, so I first need to get the legal part reviewed by my legal representative. I need one last approval which I will get soon, then sign the CLA.

Romain-Geissler-1A · 2025-05-26T08:19:20Z

Is there a release 0.63 planned soon ? If not, is there any new 0.62.x released planned soon where this could be backported to have it in a stable release soon ?

DmitriyLewen · 2025-05-26T08:44:00Z

We plan to release v0.63.0 this week - https://github.com/aquasecurity/trivy/milestone/49

knqyf263 · 2025-05-26T09:24:41Z

The default content sets were originally created for CentOS, which does not include buildinfo, so they should not be necessary for RHEL. If the mapping to CPE isn’t working properly, then it must be due to a different issue.

Separately, support for vulnerability scanning on RHEL 10 has not been completed due to the issue with Red Hat’s new data source. At present, while SBOM scanning is possible, vulnerability scanning is not, so RHEL 10 cannot be considered a supported version.

Romain-Geissler-1A · 2025-05-26T17:10:26Z

which does not include buildinfo, so they should not be necessary for RHEL. If the mapping to CPE isn’t working properly, then it must be due to a different issue.

In my case, it was needed for a RHEL 10 image. More accurately, the scan is "ok" if I scan directly registry.access.redhat.com/ubi10/ubi:latest but if I create any image from registry.access.redhat.com/ubi10/ubi:latest when I dnf install -y anything, then it's no longer ok (unable to find CPE indices) and effectively we have repositories: [] and nvrs: []. I naively thought adding a new RHEL 10 entry pasted from RHEL 9 was enough (and from my test, it was), so I didn't try to dig further in the code. What's the expected way it should work then ? If I can try to look at another bug in the code, I can, with possibly some guidance for someone who discovered this codebase last Friday ;)

At present, while SBOM scanning is possible, vulnerability scanning is not, so RHEL 10 cannot be considered a supported version.

At the moment for our use case (Service Now image scanning, which uses Trivy under the hood, and we care about package content, not vulnerabilities, as we have other scanners for vulnerabilities) we try to have the scan at least "work" without error, while now we have errors and thus we totally loose in Service Now the container content. So shall I change the doc change here to mark only RHEL 9 as fully supported and RHEL 10 as partially supported ?

Romain-Geissler-1A · 2025-05-26T17:15:59Z

Ok I get from where the content sets shall come now. If I look inside a raw UBI 10 container I can see this:

[root@ecba87f0fcae /]# cat /usr/share/buildinfo/content-sets.json
{
  "metadata": {
    "icm_version": 1,
    "icm_spec": "https://raw.githubusercontent.com/containerbuildsystem/atomic-reactor/master/atomic_reactor/schemas/content_manifest.json",
    "image_layer_index": 0
  },
  "from_dnf_hint": true,
  "content_sets": [
    "rhel-10-for-aarch64-appstream-rpms",
    "rhel-10-for-aarch64-appstream-source-rpms",
    "rhel-10-for-aarch64-baseos-rpms",
    "rhel-10-for-aarch64-baseos-source-rpms",
    "rhel-10-for-ppc64le-appstream-rpms",
    "rhel-10-for-ppc64le-appstream-source-rpms",
    "rhel-10-for-ppc64le-baseos-rpms",
    "rhel-10-for-ppc64le-baseos-source-rpms",
    "rhel-10-for-s390x-appstream-rpms",
    "rhel-10-for-s390x-appstream-source-rpms",
    "rhel-10-for-s390x-baseos-rpms",
    "rhel-10-for-s390x-baseos-source-rpms",
    "rhel-10-for-x86_64-appstream-rpms",
    "rhel-10-for-x86_64-appstream-source-rpms",
    "rhel-10-for-x86_64-baseos-rpms",
    "rhel-10-for-x86_64-baseos-source-rpms"
  ]
}

and I see code trying to parse this in https://github.com/aquasecurity/trivy/blob/main/pkg/fanal/analyzer/buildinfo/content_manifest.go#L45 I will debug further to check why it doesn't work properly.

Romain-Geissler-1A · 2025-05-26T23:26:01Z

After investigation, I propose a better fix for the RHEL 10 case in #8924. This new pull request doesn't wrongly pretend that RHEL 10 is supported, but at least it allows to scan a RHEL 10 image without error.

knqyf263 · 2025-05-27T05:40:03Z

So shall I change the doc change here to mark only RHEL 9 as fully supported and RHEL 10 as partially supported ?

Yes, it's more accurate as vulnerability scanning doesn't work with RHEL 10.

After investigation, I propose a better fix for the RHEL 10 case in #8924. This new pull request doesn't wrongly pretend that RHEL 10 is supported, but at least it allows to scan a RHEL 10 image without error.

Thanks for your investigation. I left a comment there.

Romain-Geissler-1A · 2025-05-27T09:27:07Z

I have renamed/changed this pull request to better reflect it's not a full RHEL 10 support. This in practices just removes the This OS version is not on the EOL list family="redhat" version="10" warning. RHEL 10 is explicitely marked as partially supported in the doc.

knqyf263 · 2025-05-29T11:22:00Z

docs/docs/coverage/os/index.md

@@ -14,7 +14,7 @@ Trivy supports operating systems for
 | [Alpine Linux](alpine.md)             | 2.2 - 2.7, 3.0 - 3.21, edge         | apk              |
 | [Wolfi Linux](wolfi.md)               | (n/a)                               | apk              |
 | [Chainguard](chainguard.md)           | (n/a)                               | apk              |
-| [Red Hat Enterprise Linux](rhel.md)   | 6, 7, 8                             | dnf/yum/rpm      |
+| [Red Hat Enterprise Linux](rhel.md)   | 6, 7, 8, 9, 10 (partial)            | dnf/yum/rpm      |


I think listing RHEL 10 (partial) as a supported version might confuse users since it's unclear what is supported. It might be better not to include it just yet, or alternatively, we could add a separate line clearly stating that only SBOM is supported.

Suggested change

| [Red Hat Enterprise Linux](rhel.md) | 6, 7, 8, 9, 10 (partial) | dnf/yum/rpm |

| [Red Hat Enterprise Linux](rhel.md) | 6, 7, 8, 9 | dnf/yum/rpm |

| [Red Hat Enterprise Linux](rhel.md) | 10 (SBOM only) | dnf/yum/rpm |

The RHEL 10 support is still partial (missing vulnerability scan) at the moment.

knqyf263

Thanks

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.63.0` -> `0.64.1` | --- ### Release Notes <details> <summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary> ### [`v0.64.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.64.1) [Compare Source](aquasecurity/trivy@v0.64.0...v0.64.1) #### Changelog - [`86ee3c1`](aquasecurity/trivy@86ee3c1) release: v0.64.1 \[release/v0.64] ([#9122](aquasecurity/trivy#9122)) - [`4e12722`](aquasecurity/trivy@4e12722) fix(misconf): skip rewriting expr if attr is nil \[backport: release/v0.64] ([#9127](aquasecurity/trivy#9127)) - [`9a7d384`](aquasecurity/trivy@9a7d384) fix(cli): Add more non-sensitive flags to telemetry \[backport: release/v0.64] ([#9124](aquasecurity/trivy#9124)) - [`53adfba`](aquasecurity/trivy@53adfba) fix(rootio): check full version to detect `root.io` packages \[backport: release/v0.64] ([#9120](aquasecurity/trivy#9120)) - [`8cf1bf9`](aquasecurity/trivy@8cf1bf9) fix(alma): parse epochs from rpmqa file \[backport: release/v0.64] ([#9119](aquasecurity/trivy#9119)) ### [`v0.64.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0640-2025-06-30) [Compare Source](aquasecurity/trivy@v0.63.0...v0.64.0) ##### Features - **cli:** add version constraints to annoucements ([#9023](aquasecurity/trivy#9023)) ([19efa9f](aquasecurity/trivy@19efa9f)) - **java:** dereference all maven settings.xml env placeholders ([#9024](aquasecurity/trivy#9024)) ([5aade69](aquasecurity/trivy@5aade69)) - **misconf:** add OpenTofu file extension support ([#8747](aquasecurity/trivy#8747)) ([57801d0](aquasecurity/trivy@57801d0)) - **misconf:** normalize CreatedBy for buildah and legacy docker builder ([#8953](aquasecurity/trivy#8953)) ([65e155f](aquasecurity/trivy@65e155f)) - **redhat:** Add EOL date for RHEL 10. ([#8910](aquasecurity/trivy#8910)) ([48258a7](aquasecurity/trivy@48258a7)) - reject unsupported artifact types in remote image retrieval ([#9052](aquasecurity/trivy#9052)) ([1e1e1b5](aquasecurity/trivy@1e1e1b5)) - **sbom:** add manufacturer field to CycloneDX tools metadata ([#9019](aquasecurity/trivy#9019)) ([41d0f94](aquasecurity/trivy@41d0f94)) - **terraform:** add partial evaluation for policy templates ([#8967](aquasecurity/trivy#8967)) ([a9f7dcd](aquasecurity/trivy@a9f7dcd)) - **ubuntu:** add end of life date for Ubuntu 25.04 ([#9077](aquasecurity/trivy#9077)) ([367564a](aquasecurity/trivy@367564a)) - **ubuntu:** add eol date for 20.04-ESM ([#8981](aquasecurity/trivy#8981)) ([87118a0](aquasecurity/trivy@87118a0)) - **vuln:** add Root.io support for container image scanning ([#9073](aquasecurity/trivy#9073)) ([3a0ec0f](aquasecurity/trivy@3a0ec0f)) ##### Bug Fixes - Add missing version check flags ([#8951](aquasecurity/trivy#8951)) ([ef5f8de](aquasecurity/trivy@ef5f8de)) - **cli:** add some values to the telemetry call ([#9056](aquasecurity/trivy#9056)) ([fd2bc91](aquasecurity/trivy@fd2bc91)) - Correctly check for semver versions for trivy version check ([#8948](aquasecurity/trivy#8948)) ([b813527](aquasecurity/trivy@b813527)) - don't show corrupted trivy-db warning for first run ([#8991](aquasecurity/trivy#8991)) ([4ed78e3](aquasecurity/trivy@4ed78e3)) - **misconf:** .Config.User always takes precedence over USER in .History ([#9050](aquasecurity/trivy#9050)) ([371b8cc](aquasecurity/trivy@371b8cc)) - **misconf:** correct Azure value-to-time conversion in AsTimeValue ([#9015](aquasecurity/trivy#9015)) ([40d017b](aquasecurity/trivy@40d017b)) - **misconf:** move disabled checks filtering after analyzer scan ([#9002](aquasecurity/trivy#9002)) ([a58c36d](aquasecurity/trivy@a58c36d)) - **misconf:** reduce log noise on incompatible check ([#9029](aquasecurity/trivy#9029)) ([99c5151](aquasecurity/trivy@99c5151)) - **nodejs:** correctly parse `packages` array of `bun.lock` file ([#8998](aquasecurity/trivy#8998)) ([875ec3a](aquasecurity/trivy@875ec3a)) - **report:** don't panic when report contains vulns, but doesn't contain packages for `table` format ([#8549](aquasecurity/trivy#8549)) ([87fda76](aquasecurity/trivy@87fda76)) - **sbom:** remove unnecessary OS detection check in SBOM decoding ([#9034](aquasecurity/trivy#9034)) ([198789a](aquasecurity/trivy@198789a)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/812 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

agentzzk · 2025-08-28T12:51:35Z

Hello! Wondering the status of supporting OS-level vulnerability scanning for RHEL 10 (i.e. the missing CPE indices issue)? Thanks!

Romain-Geissler-1A requested a review from knqyf263 as a code owner May 23, 2025 23:34

Romain-Geissler-1A mentioned this pull request May 24, 2025

Scanning failure for non-amd64 Red Hat images created before June 2020 aquasecurity/trivy-db#435

Closed

DmitriyLewen approved these changes May 26, 2025

View reviewed changes

DmitriyLewen enabled auto-merge May 26, 2025 05:29

DmitriyLewen disabled auto-merge May 26, 2025 09:26

Romain-Geissler-1A mentioned this pull request May 26, 2025

fix(redhat): Also try to find buildinfo in root layer (layer 0) #8924

Merged

6 tasks

Romain-Geissler-1A force-pushed the main branch from 24428ce to 4fd4908 Compare May 27, 2025 09:25

Romain-Geissler-1A changed the title ~~feat(redhat): Add support for RHEL 10.~~ feat(redhat): Add EOL date for RHEL 10. May 27, 2025

knqyf263 reviewed May 29, 2025

View reviewed changes

feat(redhat): Add EOL date for RHEL 10.

a9ff505

The RHEL 10 support is still partial (missing vulnerability scan) at the moment.

Romain-Geissler-1A force-pushed the main branch from 4fd4908 to a9ff505 Compare May 29, 2025 22:02

knqyf263 approved these changes Jun 2, 2025

View reviewed changes

knqyf263 added this pull request to the merge queue Jun 2, 2025

Merged via the queue into aquasecurity:main with commit 48258a7 Jun 2, 2025
17 checks passed

aqua-bot mentioned this pull request May 30, 2025

release: v0.64.0 [main] #8955

Merged

	\| [Red Hat Enterprise Linux](rhel.md) \| 6, 7, 8, 9, 10 (partial) \| dnf/yum/rpm \|
	\| [Red Hat Enterprise Linux](rhel.md) \| 6, 7, 8, 9 \| dnf/yum/rpm \|
	\| [Red Hat Enterprise Linux](rhel.md) \| 10 (SBOM only) \| dnf/yum/rpm \|

feat(redhat): Add EOL date for RHEL 10. #8910

feat(redhat): Add EOL date for RHEL 10. #8910

Uh oh!

Conversation

Romain-Geissler-1A commented May 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

CLAassistant commented May 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented May 23, 2025

Uh oh!

DmitriyLewen left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Romain-Geissler-1A commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Romain-Geissler-1A commented May 26, 2025

Uh oh!

DmitriyLewen commented May 26, 2025

Uh oh!

knqyf263 commented May 26, 2025

Uh oh!

Romain-Geissler-1A commented May 26, 2025

Uh oh!

Romain-Geissler-1A commented May 26, 2025

Uh oh!

Romain-Geissler-1A commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

knqyf263 commented May 27, 2025

Uh oh!

Romain-Geissler-1A commented May 27, 2025

Uh oh!

knqyf263 May 29, 2025

Choose a reason for hiding this comment

Uh oh!

Romain-Geissler-1A May 29, 2025

Choose a reason for hiding this comment

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

agentzzk commented Aug 28, 2025

Uh oh!

Uh oh!

Romain-Geissler-1A commented May 23, 2025 •

edited

Loading

CLAassistant commented May 23, 2025 •

edited

Loading

DmitriyLewen left a comment •

edited

Loading

Romain-Geissler-1A commented May 26, 2025 •

edited

Loading

Romain-Geissler-1A commented May 26, 2025 •

edited

Loading