golang-github-aquasecurity-trivy-kubernetes 0.9.1-1

Package Information

Description	Trivy Kubernetes Library Supports trivy <-> kubernetes communication for resources scanning. This Lib purpose is to extend trivy capabilities with kubernetes context: - Listing resources - Run k8s jobs - Listing KBOM
Maintainer	Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Sponsor	maytham@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/go-team/packages/golang-github-aquasecurity-trivy-kubernetes.git (browse)
Closes	#1152498
Tracker	https://tracker.debian.org/pkg/golang-github-aquasecurity-trivy-kubernetes
Uploaded	2 hours ago

New Package Report

.changes◂

Changed-By	Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Architecture	source all
Distribution	unstable
Date	Fri, 30 Oct 2026 13:59:38 +0100
Source	golang-github-aquasecurity-trivy-kubernetes
Version	0.9.1-1

Changelog◂

golang-github-aquasecurity-trivy-kubernetes (0.9.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1152498)

.dsc◂

Priority	optional
Component	main
Package-List	golang-github-aquasecurity-trivy-kubernetes-dev deb golang optional arch=all
Section	golang

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Source: https://github.com/aquasecurity/trivy-kubernetes
Upstream-Name: trivy-kubernetes
Upstream-Contact: https://github.com/aquasecurity/trivy-kubernetes/issues

Files: *
Copyright: 2022 Jose Donizetti <jdbjunior@gmail.com>
           2022-2024 chenk <hen.keinan@gmail.com>
           2024-2025 afdesk <work@afdesk.com>
           2024-2025 Simar <simar@linux.com>
           2023-2024 Bishwa Thapa <https://github.com/thapabishwa>
License: Apache-2.0
Comment: Upstream has no copyright notice (LICENSE carries the unfilled
 Apache-2.0 appendix and no file has a header). The holders are the authors
 of the commits in the upstream history.

Files: debian/*
Copyright: 2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
 https://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
Comment:
 On Debian systems, the complete text of the Apache version 2.0 license
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 1 hour ago.

Report◂

DFSG NEW review for golang-github-aquasecurity-trivy-kubernetes version 0.9.1-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: No
Issues: 0 blocker, 0 important, 3 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

The whole tree is Apache-2.0: LICENSE carries the Apache-2.0 text, no source file carries a copyright or licence header, there is no NOTICE file and no vendored third-party code, and no file carries non-free terms. debian/copyright is DEP-5, has a correct Format, a Files: * stanza covering every path (including imgs/, .github/ and the testdata), a debian/* stanza, and a stand-alone Apache-2.0 paragraph referring to /usr/share/common-licenses/Apache-2.0. The holder list is inferred from commit authorship, which the file says in a Comment; the prescan's author check found no holder in the tree that is not named.

Packaging

The packaging is otherwise conventional Go team packaging (compat 14, dh-go, autopkgtest-pkg-go, DEP-5, Vcs-* fields, Standards-Version 4.7.4 against Policy 4.7.4.1), but two defects remain: the binary package's Depends field starts with an empty element ("Depends: ,"), which is not valid relationship-field syntax, and a Build-Depends on golang-github-aquasecurity-trivy-checks-dev names a binary package that exists neither in the archive nor in NEW, while the default (non-nocheck) build compiles a test that imports it. debian/rules also removes the whole pkg/trivyk8s/trivyk8s_test.go from the build tree, discarding unit tests that need no Docker.

Issues

minor packaging 1. Binary package Depends field begins with an empty element ("Depends: ,") ◂

Files: debian/control:35
Basis: checked, in the package or with a reference tool
Evidence:

Package: golang-github-aquasecurity-trivy-kubernetes-dev
...
Depends: ,
golang-github-aws-aws-sdk-go-v2-dev,
Problem: Policy 7.1 defines a relationship field as a list of package names separated by commas; the leading comma makes the first element an empty dependency, which is not a package name. dpkg-gencontrol copies the field into the binary package unchanged, so the -dev package ships a malformed Depends that apt/dpkg may reject or handle inconsistently. Because compat is 14 the field is present at all only because it was written out by hand, which is where the stray comma came in.
Fix: Delete the comma so the field begins with the first package name: Depends: golang-github-aws-aws-sdk-go-v2-dev,.

minor packaging 2. Build-Depends on golang-github-aquasecurity-trivy-checks-dev, a package that exists nowhere in the archive or NEW ◂

Files: debian/control:22, pkg/jobs/collector_test.go:7
Basis: checked, in the package or with a reference tool
Evidence:

Build-Depends: ... golang-github-aquasecurity-trivy-checks-dev <!nocheck>, ...

pkg/jobs/collector_test.go:
trivy_checks "github.com/aquasecurity/trivy-checks"
Problem: apt-cache show golang-github-aquasecurity-trivy-checks-dev reports no such binary package in the package lists and none among the uploads waiting in NEW. The dependency is test-only, so a nuit? no: a nocheck build is fine, but a default build does not enable that profile, so sbuild must satisfy it and fails before any work; and the buildsystem runs go test over every build target (sub test in /usr/share/perl5/Debian/Debhelper/Buildsystem/golang.pm calls go test -v on the get_targets list), which compiles pkg/jobs/collector_test.go and its trivy-checks import. The same missing source would also break the autopkgtest-pkg-go run.
Fix: Drop the Build-Depends and stop running that test (exclude the package, or patch out the tests that need trivy-checks) until the trivy-checks source is accepted into the archive; alternatively hold the upload until golang-github-aquasecurity-trivy-checks-dev is in NEW and available to the build daemons.

minor packaging 3. rules deletes all of pkg/trivyk8s/trivyk8s_test.go, losing unit tests that need no Docker ◂

Files: debian/rules:14, pkg/trivyk8s/trivyk8s_test.go:26, pkg/trivyk8s/trivyk8s_test.go:61, pkg/trivyk8s/trivyk8s_test.go:107
Basis: checked, in the package or with a reference tool
Evidence:

execute_after_dh_auto_configure:
rm -f debian/_build/src/github.com/aquasecurity/trivy-kubernetes/pkg/trivyk8s/trivyk8s_test.go
Problem: Only TestListArtifacts (line 156) starts a k3s container through testcontainers-go, which is not packaged in Debian; TestIgnoreNodeByLabel (26), TestFilterResource (61) and TestInitResources (107) are pure in-memory tests of the same package. Removing the file in a build hook throws those away instead of only the Docker-dependent test, so the package ships and autopkgtests with strictly less coverage than upstream, and the removal is invisible to anyone reading the source package (a patch would show it).
Fix: Carry a debian/patches quilt patch that drops TestListArtifacts and the testcontainers/k3s imports, keeping the other three tests, instead of deleting the file from the build tree in debian/rules; forward the split upstream.

Verified ◂

Read all files under debian/ (changelog, control, copyright, gbp.conf, rules, salsa-ci.yml, source/format, upstream/metadata) in full; debian/watch was left to the separate check.
LICENSE is the verbatim Apache-2.0 text with the unfilled appendix; a tree-wide grep for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU ... General Public, Apache License, Mozilla Public, public domain and All rights reserved found the licence only in LICENSE and debian/copyright, and no header in any .go or .yaml file.
No NOTICE/COPYING/AUTHORS file and no vendor/ directory; all Go dependencies are Debian -dev packages, so there is no embedded third-party code.
Tests data under pkg/artifacts/testdata, pkg/jobs/testdata, pkg/trivyk8s/testdata and tests/integrations/testdata are small Kubernetes objects and node-collector command/config fixtures with no notices of their own; they are covered by Files: * Apache-2.0.
imgs/k8s-summary.png is a single PNG screenshot of trivy output (binary file, not opened); it is covered by the Files: * Apache-2.0 stanza and no other licence evidence exists for it.
No file of the tree carries non-commercial, no-modification or field-of-use wording (grep for non-commercial, no modification, good, not evil, educational use, field of use found nothing).
debian/changelog: 0.9.1-1, unstable, initial release closing ITP #1152498, date in the past and weekday correct.
Standards-Version 4.7.4 against Policy 4.7.4.1 (the reviewing system's policy tool) — same first two components, not an issue.
Build-Depends/Depends names checked with apt-cache: dh-go 1.69 (provides the golang addon and buildsystem), dpkg-build-api (= 1) provided by dpkg-dev 1.23.11, golang-github-aws-aws-sdk-go-v2-dev, golang-github-dsnet-compress-dev, golang-github-google-go-containerregistry-dev, golang-github-mitchellh-mapstructure-dev, golang-github-opencontainers-go-digest-dev, golang-k8s-utils-dev, golang-k8s-kubectl-dev and golang-k8s-cli-runtime-dev all exist.
Every import of the non-test sources (aws-sdk-go-v2, dsnet/compress, go-containerregistry, go-digest, mapstructure, gopkg.in/yaml.v3, sigs.k8s.io/yaml, k8s.io/api, apimachinery, cli-runtime, client-go, utils) is matched by a Build-Depends and by a Depends of the -dev package; testify and k8s.io/kubectl are used only by tests and are marked <!nocheck>, which is right.
The absence of ${misc:Depends}/${shlibs:Depends} at debhelper compat 14 is not reported: dh_gencontrol adds relationship substvars itself at that level.
uscan found the packaged version as the newest upstream release (upstream 0.9.1, packaged 0.9.1).
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

The go.mod/go.work rewriting in debian/rules (fabricated go.mod files for modules without one, added requires for evanphx/json-patch/v5 and cel.dev/cel-go, a COMPAT tree for autopkgtest, and sed on the installed golang-github-peterbourgon-diskv-dev sources) is extensive and its correctness can only be shown by a build, which I cannot run; a build would show whether the module-mode path compiles against the 0.36.x Kubernetes -dev packages while upstream go.mod asks for 0.33.2.
The copyright holders in Files: * are said to come from the upstream commit history; the tarball has no .git, so I could not check the list of authors against it.

Proposed changes ◂

None.

Uploader's response to the LLM review

Thanks. 1 and 3 are right and fixed for the next revision: Depends starts with ${misc:Depends}, and a DEP-3 patch drops only TestListArtifacts, so the three in-memory tests run again: https://salsa.debian.org/go-team/packages/golang-git
hub-aquasecurity-trivy-kubernetes/-/commit/03f06f0d15cdc204daa9050eb3bb8eb64e8fe4d3 .

2: trivy-checks was accepted into unstable on 2026-11-08.

Please accept this upload.

— Juan Manuel Méndez Rey (mendezr), 1 hour ago

Back to Dashboard | View all reviews for this package