apply OS-level CVE data to OS-provided go and rust binaries

[kaniini]

I am working on using Trivy to scan Alpine-provided Go and Rust packages for vulnerabilities. This has already proven to be very useful, we have already mitigated a few CVEs that we had no visibility into.

However, the security team may choose to issue "true negative" secfixes data for some packages.

The problem is that Trivy does not consider OS-level security fix data when listing vulnerabilities in these binaries themselves. It would be nice to do so if the binary is "owned" by the package manager (/lib/apk/db/installed contains all the registered paths a package should have).

Would it be possible to correlate this data?

[knqyf263]

We already extract installed files by package managers, then skip scanning those files.
https://github.com/aquasecurity/fanal/blob/63f3f8193fa84a52a7c148aca0d996a1dca8735f/analyzer/pkg/apk/apk.go#L81-L82

If a python package is installed by apk, it should be skipped. But it skips Ruby, Python and Node.js packages for now.
https://github.com/aquasecurity/fanal/blob/63f3f8193fa84a52a7c148aca0d996a1dca8735f/hook/filter/filter.go#L26-L35

I've added Go binaries as well in #481. We don't support Rust binaries currently.