Hardening CI/CD Against CA Key Compromise: Dissecting Trivy v0.76.1 and Go Trust Stores

In modern DevSecOps pipelines, vulnerability scanners such as Aqua Security's Trivy form the core barrier between unvetted source code and production container runtime environments. However, automated scanners are themselves software applications subject to the fundamentals of transport layer security and Public Key Infrastructure (PKI).

The release of Trivy v0.76.1 highlights a critical, often-overlooked failure mode in distributed supply chain security: intermediate Certificate Authority (CA) compromise.

1. Problem Statement & Production Failure Modes

The root issue stems from the eMudhra intermediate CA key compromise.…