Trivy Can Now Scan Unpackaged Binary Files

Trivy v0.33 introduces an experimental feature that enables vulnerability scanning of standalone binaries by resolving their SBOMs through Sigstore’s Rekor transparency log: Trivy computes a binary hash, queries Rekor for an attested SBOM (e.g., CycloneDX), and uses that SBOM to perform package-level vulnerability detection. The post explains the architecture and workflow, lists prerequisites and commands, and demonstrates the process with a Rust application—covering SBOM generation, attestation upload via the trivy-plugin-attest/Cosign flow, and scanning a container image with the --sbom-sources rekor flag.