Commercial use for Current version trivy's license.

[bluefriday]

In previous version(v0.17.0), there was some data sources that was a non-commercial in trivy.

• https://aquasecurity.github.io/trivy/v0.17.0/vuln-detection/data-source/

---

After two releases, the current version does not appear to have any non-commercial data sources.

• 7fcbf44 refactor(python): drop Safety DB (#1580)
• 5d57dea fix(docs): remove OSVDB advisories (#1215)

---

However, in the case of a specific data source (Ruby Advisory Datasource), the datasource remains the same, only the status has been changed to Commercial Use.
((I mean, There is still remain 'Ruby Advisory Database' in 'trivy' data source list)

Ruby Advisory Database
https://github.com/rubysec/ruby-advisory-db/blob/master/LICENSE.txt

However, not all of the ruby-advisory-db can be considered public domain.
The ruby-advisory-db may contain some information copyrighted by the Open
Source Vulnerability Database (http://osvdb.org). If you use ruby-advisory-db
data to build a product or a service, it is your responsibility to familiarize
yourself with the terms of their license: http://www.osvdb.org/osvdb_license
(you may need to use a web archive service to view the license).

I wonder if there will be any problem even if all current trivy data sources, including OSVDB, are used commercially.

[knqyf263]

We tried to remove OSV advisories.
rubysec/ruby-advisory-db#456

But some of the OSV advisories still remain.
rubysec/ruby-advisory-db#487

We skipped them in the below PR.
aquasecurity/trivy-db#148

[bluefriday]

We tried to remove OSV advisories. rubysec/ruby-advisory-db#456

But some of the OSV advisories still remain. rubysec/ruby-advisory-db#487

We skipped them in the below PR. aquasecurity/trivy-db#148

Thanks for your reply.
I understand now that current Trivy db is available for commercial use :D
But I don't know why the 'Ruby Advisory Database' still exists in the Trivy datasource(https://github.com/aquasecurity/trivy/blob/main/docs/vulnerability/detection/data-source.md)

[knqyf263]

As you can see in the above PR, we didn't drop Ruby Advisory Database completely. We just dropped only advisories from OSVDB.

[github-actions]

This issue is stale because it has been labeled with inactivity.