Support for regex in trivyignore.yaml

[Smasherr]

Description

When I perform vulnerability scanning with Trivy, I would like to apply the OWASP-suppressions.
For that purpose, I started implementing a small tool to convert from OWASP-suppressions' format to .trivyignore.yaml. One feature I miss in Trivy is the specification of packageUrl/purl as regexp.
An example of how it might look in a suppressions XML:

<packageUrl regex="true">^pkg:maven/org\.springframework/spring.*$</packageUrl>

I suggest introducing a new field in .trivyignore.yaml purl_re in regexp format to be used as an alternative to purls which is a string array.

Target

None

Scanner

Vulnerability

[knqyf263]

Thanks for the suggestion. I'd like to see how the community responds to get a sense of how much this feature is being requested.

[sagiru]

That would be a nice feature for us...we have also the requirement to use regexes for version matches.