The safeguards map / 1.1 Code and dependencies
zot (CVE scanning)
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
zot's CVE scanning extension scans the container images stored in the registry with Trivy and can write an SPDX SBOM for each as an OCI artifact.
Where it sits
1.1 Code and dependencies (primary): Scans stored container images for known vulnerabilities with an embedded Trivy, returns the results through its search API and command line, and can store a generated SBOM beside the image.
The CVE scanning feature enables zot to: Scan container images for known vulnerabilities
captured
The CVE scanning extension integrates Trivy as a library to perform vulnerability scans
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who distribute it
- Runs
- at runtime
Handoffs
produces Software and AI inventory: SPDX JSON SBOM stored as an OCI artifact
Collector's note
The entry covers the CVE scanning extension only, not zot as an OCI registry. The SBOM format is set in configuration (the docs example uses spdx-json). Signature verification in zot records whether an image is trusted and is not placed here, because the docs show no gate on it.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.