$ show aquasecurity/trivy
Trivy is a comprehensive, production-grade security scanner for container images, filesystems, Git repositories, Kubernetes clusters, cloud infrastructure (IaC), and virtual machines. It detects vulnerabilities in OS packages and language-specific dependencies, scans for IaC misconfigurations (Terraform, CloudFormation, ARM, Ansible, Helm, Dockerfile), secrets, and license compliance. The architecture is modular: a CLI entry point (`cmd/trivy/main.go`) orchestrates scanning via a file analysis engine (`pkg/fanal`), dependency parsers (`pkg/dependency/parser`), vulnerability detectors (`pkg/detector`), IaC scanners with Rego-based policies (`pkg/iac`), and multiple output formats (JSON, SARIF, CycloneDX, SPDX, table, etc.). It supports client-server mode via gRPC, a plugin system, WASM modules, and VEX/SBOM attestation integration. The codebase is well-structured with clear separation of concerns, extensive test coverage, and many reusable utility packages (parallel processing, generic sets, caching, version constraints, license expression parsing). It is actively maintained with frequent releases and a large community.
The LLM identified 6 files worth highlighting for reuse:
A generic parallel pipeline that processes items concurrently with configurable concurrency, error aggregation, and optional progress bar support. It is self-contained, uses Go generics, and can be extracted for any batch processing task requiring controlled parallelism.
A generic Set implementation with union, intersection, difference, and subset operations. It is thread-safe and provides a clean API. Easily reusable in any Go project needing set semantics.
A context-based clock abstraction that allows injecting fake time for testing. It provides Now, After, and Sleep methods. This pattern is essential for testable time-dependent code and is trivially extractable.
A lexer and parser for SPDX license expressions (AND, OR, WITH, +). It normalizes and validates license strings. The implementation is self-contained and demonstrates non-trivial parsing skill. Can be reused in any license compliance tool.
A cache abstraction layer with multiple backends (local filesystem, Redis, remote HTTP) and a key computation mechanism based on content hashes. The interface is clean and the implementations are decoupled. Reusable for any application needing pluggable caching.
A version constraint parser that supports operators like >=, <, ==, and ranges. It uses regex-based parsing and provides a simple API for checking if a version satisfies constraints. Self-contained and reusable for any version comparison logic.