Update github.com/theupdateframework/go-tuf library as it has HIGH-severity vulnerability

[sinke237]

Question

Before you freak out i have read the contributing.md

Unfortunately it has not given me enough info about how I should start.
I have seen something that will me particularly glad if I am the one who fixed it(see the attachment)

I will love to talk with someone who can hint me how to go about this.

Target

None

Scanner

None

Output Format

None

Mode

None

Operating System

No response

Version

No response

[itaysk]

Hi, if you have something you would like to work on, please start a Discussions with the appropriate category (Bug/Idea) and explain what it is and what you intend to do about it. We might discuss the validity or implementation details and if theres concensus we will you can start working on it, and eventually submit a Pull Request. We will review the Pull Request and possibly provide feedback, and finally merge it.

[sinke237]

Hi @itaysk ,
Thank you for your attention to this. It's encouraging to see your interest.

My intention is to:

Use the aquasec/trivy Docker image to perform vulnerability testing.
I began by scanning the image itself and discovered a HIGH-severity vulnerability.

Given that this is a security concern, it's not feasible to use this image in my pipeline for scanning.

While I find trivy incredibly helpful, I've considered contributing to the project.

I'd like to start by:

Updating the library with the HIGH-severity vulnerability (as seen in the attachment).
I would appreciate your validation of this finding and guidance on how I can continue to contribute effectively to this excellent project.

[itaysk]

it seems this is an indirect dependency and we need to wait to rekor for updating it. you can try to contribute it there if you want