scan: add a warning when age is older than 48h for now

Signed-off-by: Hector Fernandez <[email protected]>

Author: hectorj2f

go.mod

@@ -68,6 +68,7 @@ require (
 require (
 	github.com/anchore/go-logger v0.0.0-20250318195838-07ae343dd722
 	github.com/chainguard-dev/advisory-schema v0.37.12
+	github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b
 	github.com/spf13/afero v1.14.0
 )
 
@@ -206,7 +207,6 @@ require (
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
-	github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-getter v1.7.8 // indirect

pkg/scan/apk.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/adrg/xdg"
+	"github.com/hako/durafmt"
 	"github.com/anchore/grype/grype"
 	v6 "github.com/anchore/grype/grype/db/v6"
 	"github.com/anchore/grype/grype/db/v6/distribution"
@@ -44,6 +45,8 @@ import (
 
 const (
 	mavenSearchBaseURL = "https://search.maven.org/solrsearch/select"
+
+	maxRecommendedBuildAge = 48 * time.Hour
 )
 
 var DefaultGrypeDBDir = path.Join(xdg.CacheHome, "wolfictl", "grype", "db")
@@ -243,6 +246,14 @@ func NewScanner(opts Options) (*Scanner, error) {
 		return nil, fmt.Errorf("failed to load vulnerability database: %w", err)
 	}
 
+	// built time is defined in UTC,
+	// we should compare it against UTC
+	now := time.Now().UTC()
+	age := now.Sub(dbStatus.Built)
+	if age > maxRecommendedBuildAge {
+		fmt.Fprintf(os.Stdout, "WARNING: the vulnerability database was built %s ago (max allowed age is %s but the recommended value is %s)\n", durafmt.ParseShort(age), durafmt.ParseShort(maxAllowedBuildAge), durafmt.ParseShort(maxRecommendedBuildAge))
+	}
+
 	if checksum == "" {
 		metadata, err := v6.ReadImportMetadata(afero.NewOsFs(), filepath.Dir(dbStatus.Path))
 		if err != nil {