Support Alpine Linux

[olds463]

Alpine linux is becoming a large part of the Docker and VM community due to its small disk/memory footprint and security standards.

https://alpinelinux.org/

It would be nice to see support for this as a scan target. It uses its own package manager, apk.

[kotakanbe]

memo : https://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management#Update_the_Package_list

[kotakanbe]

Hi @olds463 :)
I usually don't use Alpine Linux.
Do you know how to detect the upgradable packages and list of CVE-IDs those are included in upgradable packages by using shell command?

[rjes]

Hi!
This seems like the most smooth way of checking if a package is upgradable: apk update && apk version
Alpine's apk doesn't seem to have CVE-IDs in their package management, is it possible to compare the package version number (maybe via some CPE lookup?)
How does CVE checking works on Debian (I don't think they ship CVE's in their package manager either)

[sbkg0002]

+1! This would make vuls the best allrounder!

[s7anley]

It's not that straightforward as parsing changelog on the analyzed node, but I give it a try.

@kotakanbe Can you assign me to the issue?

[kotakanbe]

@s7anley I sent you an invitation as a collaborator to assign you to this issue.

[s7anley]

@kotakanbe Accepted.