Better name for cache storing results from analyzers

[knqyf263]

Background

We need a different name to distinguish between a general cache, including vulnerability DB, and a specific cache for storing analysis results. The cache stores results from analyzers but not all scan results.

Current Situation

We tentatively named it "scan cache" , but there are other candidates, such as "layer cache" or "analysis cache", but we're open to better suggestions.

Considerations for "layer cache"

As @DmitriyLewen pointed out here, the name 'layer cache' can mislead users into thinking that layer contents are stored.

Considerations for "analysis cache"

There are two concerns.

1. Lack of familiarity with the "analyzer" concept:

   • Trivy is designed to be user-friendly without requiring deep understanding of internal workings.
   • The "analyzer" concept doesn't appear in documentation or CLI, making "analysis cache" potentially confusing.
   • Introducing "analysis cache" would necessitate explaining the analyzer concept first.

2. Inconsistent storage of scan results:

   • Vulnerabilities and license results are not stored in the cache.
   • Misconfigurations and secrets are stored as actual scan results.
     • For misconfiguration scans, IaC file contents need to be cached, which:
       a. Can be large in size
       b. Might accidentally include sensitive information
   • To mitigate these issues, security scanning occurs within the analyzer, and sensitive information is masked before caching.
   • The term "analysis cache" might be misleading given this complexity.

Rationale for "scan cache"

• Simpler and more intuitive for users
• Describes its purpose in the context of the scanning process without delving into internal details
• Avoids potential confusion about what exactly is being cached