How to interface trivy.db externally using python?

[morpheuslord]

According to the README, I downloaded the trivy.db file but I could not use it directly using SQLite so I checked the file type and it just returned Data. I don't know how to write an interfacing code for this, but I want to integrate this into my project. Do you have any tips for me?

[knqyf263]

Trivy DB is built with bbolt. I'm not sure there is a Python binding.

[morpheuslord]

Trivy DB is built with bbolt. I'm not sure there is a Python binding.

Will check it, thanks for the info 👍

[morpheuslord]

@knqyf263 I was able to write a go script to convert this to a sqlite3 db file

package main

import (
    "database/sql"
    "flag"
    "fmt"
    "log"

    "go.etcd.io/bbolt"
    _ "github.com/mattn/go-sqlite3"
)

func main() {
    // Define command-line flags
    dbInput := flag.String("db-input", "trivy.db", "Path to the bbolt database file")
    sqliteOutput := flag.String("sqlite-output", "output.db", "Path to the output SQLite database file")

    // Parse the command-line flags
    flag.Parse()

    // Open the bbolt database
    db, err := bbolt.Open(*dbInput, 0600, nil)
    if err != nil {
        log.Fatal(err)
    }
    defer db.Close()

    // Create or open the SQLite database
    sqliteDB, err := sql.Open("sqlite3", *sqliteOutput)
    if err != nil {
        log.Fatal(err)
    }
    defer sqliteDB.Close()

    // Iterate over the BoltDB data and insert into SQLite
    err = db.View(func(tx *bbolt.Tx) error {
        return tx.ForEach(func(bucketName []byte, b *bbolt.Bucket) error {
            // Create a table for each bucket
            tableName := string(bucketName)
            createTableQuery := fmt.Sprintf(`CREATE TABLE IF NOT EXISTS "%s" (key TEXT PRIMARY KEY, value TEXT)`, tableName)
            _, err := sqliteDB.Exec(createTableQuery)
            if err != nil {
                return fmt.Errorf("failed to create table %s: %v", tableName, err)
            }

            // Insert data into the table
            insertStmt, err := sqliteDB.Prepare(fmt.Sprintf(`INSERT INTO "%s" (key, value) VALUES (?, ?)`, tableName))
            if err != nil {
                return err
            }
            defer insertStmt.Close()

            return b.ForEach(func(k, v []byte) error {
                _, err := insertStmt.Exec(string(k), string(v))
                if err != nil {
                    return fmt.Errorf("failed to insert data into table %s: %v", tableName, err)
                }
                return nil
            })
        })
    })
    if err != nil {
        log.Fatal(err)
    }

    fmt.Printf("Data exported to SQLite database %s\n", *sqliteOutput)
}

But now the issue is, apart from the vulnerability information rest of the information is just empty none of the values are present in the DB how is that useful, how can I make sure I have that data?? do you have any ideas about that?