diff --git a/trivy-releases/.gitignore b/trivy-releases/.gitignore
new file mode 100644
index 00000000..1dc3db6a
--- /dev/null
+++ b/trivy-releases/.gitignore
@@ -0,0 +1,5 @@
+*.tar.gz
+cf-terraformer_*/
+linux/**
+Linux/**
+*.sig
diff --git a/trivy-releases/VERSION b/trivy-releases/VERSION
new file mode 100644
index 00000000..04530c83
--- /dev/null
+++ b/trivy-releases/VERSION
@@ -0,0 +1 @@
+0.67.2
diff --git a/trivy-releases/get.sh b/trivy-releases/get.sh
new file mode 100755
index 00000000..c8fe11d7
--- /dev/null
+++ b/trivy-releases/get.sh
@@ -0,0 +1,134 @@
+#!/bin/bash
+
+THIS_VERSION="1.1.0"
+THIS=$(basename $0)
+
+ARG=$1
+OS=$2
+
+# https://github.com/aquasecurity/trivy/releases/download/v0.67.2/trivy_0.67.2_Linux-64bit.tar.gz
+# https://github.com/aquasecurity/trivy/releases/download/v0.67.2/trivy_0.67.2_Linux-64bit.tar.gz.pem
+# https://github.com/aquasecurity/trivy/releases/download/v0.67.2/trivy_0.67.2_Linux-64bit.tar.gz.sig
+
+
+REPONAME="aquasecurity"
+BINNAME="trivy"
+BINEXTENSION=""
+PROGNAME="trivy"
+if [ -z "$OS" ]
+then
+  OS="Linux"
+fi
+if [[ "$OS" != "linux" ]] && [[ "$OS" != "windows" ]] && [[ "$OS" != "darwin" ]] && [[ "$OS" != "Linux" ]]
+then
+  echo "* invalid $OS, exiting"
+  exit 1
+fi
+
+PLATFORM="64bit"
+URL="https://github.com/$REPONAME/$BINNAME/releases/download/v%%VERSION%%/${PROGNAME}_%%VERSION%%_${OS}-${PLATFORM}.tar.gz"
+GPG_URL="https://github.com/$REPONAME/$BINNAME/releases/download/v%%VERSION%%/${PROGNAME}_%%VERSION%%_${OS}-${PLATFORM}.tar.gz.sig"
+#SHA256_URL="https://github.com/$REPONAME/$BINNAME/releases/download/v%%VERSION%%/checksums.txt"
+
+if [ -z $VERSION ]
+then
+  version=$(cat VERSION)
+fi
+v_major=$(echo $version| awk -F\. '{print $1 "." $2}')
+v_minor=$(echo $version| awk -F\. '{print $3}')
+v_minor_next=$(( $v_minor + 1 ))
+version_next="${v_major}.${v_minor_next}"
+
+if [[ $ARG == "current" ]]
+then
+  version_next=$version
+fi
+
+S_URL=$(echo $SHA256_URL | sed -e "s/%%VERSION%%/$version_next/g")
+if [ ! -z "$S_URL" ]
+then
+  sfile=$(basename $S_URL)
+fi
+if [ ! -r "$sfile" ]
+then
+  echo "* downloading SHA256sum for $version_next"
+  curl -L -s -f -k "$S_URL" -o $sfile 2> /dev/null
+fi
+
+if [[ -z $ARG ]] || [[ $ARG == "get" ]] || [[ $ARG == "current" ]]
+then
+  T_URL=$(echo $URL | sed -e "s/%%VERSION%%/$version_next/g")
+  file=$(basename $T_URL)
+  echo "* old $version, attempting next version $version_next"
+  curl -L -s -f -k "$T_URL" -o $file 2> /dev/null
+  status=$?
+
+  GT_URL=$(echo $GPG_URL | sed -e "s/%%VERSION%%/$version_next/g")
+  if [ ! -z "$GT_URL" ]
+  then
+    gfile=$(basename $GT_URL)
+    echo "* old $version, attempting next version $version_next gpgsig"
+    curl -L -s -f -k "$GT_URL" -o $gfile 2> /dev/null
+    gstatus=$?
+  else
+    gstatus=0
+  fi
+
+  if [ $status == 0 ]
+  then
+#    cp $file ${BINNAME}_${version_next}${BINEXTENSION}
+#    chmod 700 $file
+#    chmod 700 ${BINNAME}_${version_next}${BINEXTENSION}
+    test -d $OS/$version_next || mkdir -p $OS/$version_next
+#    unzip $file -d $OS/$version_next/
+    tar -xzf $file --directory $OS/$version_next/
+
+    echo $version_next > VERSION
+    echo "* downloaded new version $version_next"
+    echo "* install new version with:"
+    echo "  ./$THIS install"
+  else
+    T_URL=$(echo $URL | sed -e "s/%%VERSION%%/$version/g")
+    echo "* version $version is current"
+    file=$(basename $T_URL)
+    if [ ! -r $file ]
+    then
+      echo "* downloading current version $version"
+      curl -L -s -f -k "$T_URL" -o $file 2> /dev/null
+      status=$?
+
+      echo "* downloading current version $version gpgsig"
+      curl -L -s -f -k "$GT_URL" -o $gfile 2> /dev/null
+      gstatus=$?
+
+      if [ $status == 0 ]
+      then
+#         cp $file ${BINNAME}_${version}${BINEXTENSION}
+        test -d $version || mkdir -p $version
+#        unzip $file -d $version/
+        tar -xzf $file --directory $version/
+      else
+        echo "x unable to download ${BINNAME}_${version}${BINEXTENSION} status=$status"
+        exit $status
+      fi
+    fi
+  fi
+fi
+
+if [[ $ARG == "install" ]] && ( [[ "$OS" == "linux" ]] || [[ "$OS" == "Linux" ]] )
+then
+  whichbin=$(which $PROGNAME 2> /dev/null)
+  if [ ! -z $whichbin ]
+  then
+    BINDIR=$(dirname $whichbin)
+  elif [ -z $BINDIR ]
+  then
+    echo "x unable to locate current $BINNAME binary, use BINDIR=path to install"
+    exit 1
+  fi
+
+  echo "* installing $PROGNAME $version into $BINDIR"
+  umask 022
+  cp ${OS}/$version/${PROGNAME} $BINDIR/${PROGNAME}_$version && ln -sf ${PROGNAME}_${version} $BINDIR/$PROGNAME
+  chmod 755 $BINDIR/${PROGNAME}_${version}
+fi