How do I ignore all vulnerabilities for a package?

[Cylindric]

Question

I am scanning a docker container we use to run the Azure pipeline agent. It needs libc-dev which means there are over 500 known CVEs at Medium and above. How can I ignore the whole package in trivyignore.yaml? I have to put a value for the id, but I want to ignore all CVEs.

vulnerabilities:
   - id: *
     statement: ignore all issues with libc-dev
     expired: 2026-04-01
     purls:
       - "pkg:deb/ubuntu/linux-libc-dev@6.8.0-106.106?arch=amd64\u0026distro=ubuntu-24.04"

Is there a way of doing this without adding 500 ignores covering every possible CVE?

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Operating System

Ubuntu 24.04

Version

Version: 0.69.3

(from the docker image at aquasec/trivy)