# trivy mit Homebrew, apk, chocolatey, dnf, MacPorts, Nix, pacman, zypper, scoop, winget installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für trivy in AI-Agent-Workflows.

## Installation

```sh
sudo av install brew:trivy
```

Weitere Installationsbefehle:

### macOS

- Homebrew (100%):

```sh
brew install trivy
```

  Evidenz: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install trivy
```

  Evidenz: MacPorts ports tree: security/trivy/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- apk (92%):

```sh
sudo apk add trivy
```

  Evidenz: Alpine Linux edge package indexes: trivy from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz

- dnf (92%):

```sh
sudo dnf install trivy
```

  Evidenz: Fedora Rawhide package metadata: trivy from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- Nix (92%):

```sh
nix profile install nixpkgs#trivy
```

  Evidenz: nixpkgs package indexes: pkgs/by-name/tr/trivy/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S trivy
```

  Evidenz: Arch Linux sync databases: trivy from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install trivy
```

  Evidenz: openSUSE Tumbleweed package metadata: trivy from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Chocolatey (92%):

```sh
choco install trivy
```

  Evidenz: Chocolatey community package catalog: trivy from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','trafficlight-chrome'

- Scoop (92%):

```sh
scoop install main/trivy
```

  Evidenz: Scoop official bucket manifest trees: bucket/trivy.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

- winget (92%):

```sh
winget install --id AquaSecurity.Trivy -e
```

  Evidenz: Windows Package Manager source index: AquaSecurity.Trivy from https://cdn.winget.microsoft.com/cache/source.msix

## Paketfakten

- **Paketschlüssel:** brew:trivy
- **Paketmanager:** Homebrew
- **Version:** 0.72.0
- **Quellzusammenfassung:** Vulnerability scanner for container images, file systems, and Git repos
- **Homepage:** <https://trivy.dev/>
- **Repository:** <https://github.com/aquasecurity/trivy>
- **Zuletzt aktualisiert:** 2026-08-03T16:34:11Z
- **Generiert:** 2026-08-03T19:37:03+00:00

## Executables

- trivy (Alias)

## Installationsverhalten

- Bottle: nicht verfügbar

## Version und Aktualität

- Seite generiert: 2026-08-03
- Manager-Version: 0.72.0
## Projektgeschichte und Nutzung

Trivy is Aqua Security's open-source security scanner. It began public life in the container-image vulnerability scanning niche and is now documented as a comprehensive scanner for container images, filesystems, Git repositories, VM images, and Kubernetes.

### Projektgeschichte

Aqua's official blog announced on August 19, 2019 that Trivy, described there as a popular open-source container image vulnerability scanner, had joined the Aqua open-source family. The current project README shows how the scope expanded: Trivy now has multiple target types and scanners, including vulnerabilities, SBOM/package inventory, IaC misconfiguration, secrets, and license scanning.

That expansion mirrors the wider cloud-native security shift from image scanning as a point task to supply-chain and runtime-adjacent checks in CI, repositories, Kubernetes clusters, and local filesystems. Trivy's own docs and README frame it as a single CLI front end for those related checks rather than a collection of separate tools.

### Adoptionsgeschichte

The official homepage calls Trivy the most popular open-source security scanner for vulnerability scanning, IaC, SBOM discovery, cloud scanning, and Kubernetes security. The README lists integrations with GitHub Actions, the Trivy Kubernetes operator, and a VS Code extension, while the installation docs distinguish official and community install channels.

Homebrew adoption fits the way Trivy is commonly used: installed as a local CLI for developers and CI authors, run in Docker for pipeline isolation, and embedded into GitHub Actions or Kubernetes workflows for continuous scanning. Its package-manager presence is not ornamental; the package is a common entry point for trying a scanner before wiring it into automation.

### Wie es verwendet wird

The README's general pattern is `trivy <target> [--scanners <scanner1,scanner2>] <subject>`. Examples include `trivy image python:3.4-alpine`, filesystem scans such as `trivy fs --scanners vuln,secret,misconfig myproject/`, and Kubernetes scans such as `trivy k8s --report summary cluster`.

In the package-nerd niche, Trivy is often used to inspect what a package, container image, repository, lockfile, or cluster would expose to a vulnerability database or policy scanner. The same executable can produce quick local answers and also serve as the scanner behind CI jobs, image-registry checks, and Kubernetes security reports.

### Warum Paket-Nerds sich dafür interessieren

Trivy is significant because it connects package metadata to security outcomes. It reads OS packages and language dependencies, maps them to CVEs and other findings, and can emit SBOM-centered views. For people who track package ecosystems, it is both a user-facing CLI and a packaging/data-source stress test across distros, language lockfiles, images, and repositories.

It is also a good example of a security CLI becoming infrastructure: package managers install it, CI systems wrap it, Kubernetes operators schedule it, and downstream tools consume its reports. That makes its history more important than a normal formula entry.

### Zeitleiste

- 2019-08-19: Aqua announced that Trivy had joined the Aqua open-source family.
- Current README: Trivy documents targets including container images, filesystems, Git repositories, VM images, and Kubernetes.
- Current README: Trivy documents scanners for vulnerabilities, SBOM/package inventory, IaC misconfiguration, secrets, and licenses.
- Current docs: Installation documentation covers official and community channels and points users to CI/CD, IDE, Kubernetes, and other integrations.

### Related projects

- Aqua Security, Trivy DB, Trivy Operator, trivy-action, Harbor scanner integrations, Kubernetes, SBOM tooling

### Quellen

- <https://github.com/aquasecurity/trivy#readme>
- <https://trivy.dev/>
- <https://trivy.dev/docs/latest/getting-started/installation/>
- <https://www.aquasec.com/blog/trivy-vulnerability-scanner-joins-aqua-family/>


## Sicherheitshinweise

broad file, network, media, or database tool signal. escape, surveillance, or offensive capability signal.

- **Geiger-Risiko:** red / mittel
- broad file, network, media, or database tool signal
- escape, surveillance, or offensive capability signal
- infrastructure mutation or orchestration signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: trivy.yaml
## Andere Paketmanager-Einträge

- Nix - trivy: normalized package name match | nixpkgs package indexes: pkgs/by-name/tr/trivy/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- apk - trivy - 0.72.0-r1: normalized package name match | Alpine Linux edge package indexes: trivy from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Simple and comprehensive vulnerability scanner for containers | https://github.com/aquasecurity/trivy
- dnf - trivy - 0.69.3-1.fc45: normalized package name match | Fedora Rawhide package metadata: trivy from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Vulnerability and license scanner | https://github.com/aquasecurity/trivy
- pacman - trivy - 0.73.0-1: normalized package name match | Arch Linux sync databases: trivy from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | A Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI | https://github.com/aquasecurity/trivy
- zypper - trivy - 0.72.0-3.2: normalized package name match | openSUSE Tumbleweed package metadata: trivy from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | A Simple and Comprehensive Vulnerability Scanner for Containers | https://github.com/aquasecurity/trivy
- MacPorts - trivy: normalized package name match | MacPorts ports tree: security/trivy/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
- Chocolatey - trivy: normalized package name match | Chocolatey community package catalog: trivy from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','trafficlight-chrome'
- Scoop - main/trivy: normalized package name match | Scoop official bucket manifest trees: bucket/trivy.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
- winget - AquaSecurity.Trivy: normalized package name match | Windows Package Manager source index: AquaSecurity.Trivy from https://cdn.winget.microsoft.com/cache/source.msix


## Combined YAML source

View the package source record on GitHub. [combined/trivy.yml](https://github.com/mxcl/pkgdb/blob/main/combined/trivy.yml)


## Quellen

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph